{"vulnerability": "CVE-2026-13142", "sightings": [{"uuid": "59c11fe5-d383-4045-b69a-ff0824fdb532", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-13142", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116951130173651435", "content": "CVE-2026-13142 | CRITICAL: Social Login, Passkeys, Magic Link & Email OTP WordPress plugin (pre-1.4.1) allows OTP brute-force due to no rate limiting + plaintext storage. Admin takeover possible. Disable or restrict plugin use until patched. https://radar.offseq.com/threat/cve-2026-13142-cwe-269-improper-privilege-management-in-social-login-passkeys-magic-link-email-otp-82bfc0c2a799f534 #OffSeq #WordPress #Vuln", "creation_timestamp": "2026-07-20T07:30:26.741763Z"}, {"uuid": "eef84fc8-d4f7-407a-a57d-0828f7fb7ac5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-13142", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mr2rkpgosv2t", "content": "CRITICAL: Social Login, Passkeys, Magic Link & Email OTP WordPress plugin pre-1.4.1 lets attackers brute-force plaintext OTPs \u2014 admin takeover possible. Patch status unconfirmed. Disable or restrict plugin use. https://radar.offseq.com/threat/cve-2026-13142-cwe-269-improper-privilege-management-i...", "creation_timestamp": "2026-07-20T07:30:28.562908Z"}, {"uuid": "4c263809-cbd5-4b71-8b8c-3669f1e014db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-13142", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr2ts4vg2l2o", "content": "CVE-2026-13142 - Passwordless Login by VentraConnect\nCVE ID : CVE-2026-13142\n \n Published : July 20, 2026, 7:16 a.m. | 28\u00a0minutes ago\n \n Description : The Social Login, Passkeys, Magic Link & Email OTP WordPress plugin before 1.4.1 does not enforce rate limiting or a worki...", "creation_timestamp": "2026-07-20T08:10:24.501460Z"}]}