{"id":"CVE-2026-121848","kind":"vulnerability","aliases":["CVE-2026-121848"],"related":[],"title":"Magic Link WordPress plugin: any logged-in user can log in as admin","description":"The Magic Link  WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber, to generate a working login link for an administrator and log in as them.","summary":"The Magic Link WordPress plugin before 2.2.6 does not verify that a user requesting a login link is allowed to create one for a chosen account. Any authenticated user, including a subscriber, can generate a working login link for an administrator and sign in as that administrator.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["magic-link-plugin","package","wordpress"],"not_affected_if":["no-user-accounts","plugin-not-installed","version-2.2.6-or-later"],"how_to_check":"- Check the installed version of the Magic Link plugin in the WordPress admin under Plugins; versions below `2.2.6` are affected.\n- Review WordPress user accounts for unexpected administrator logins or new admin users.","fix":"- Magic Link plugin: move to `2.2.6` or later.","status":"open","published_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","triaged_at":"2026-11-07T06:48:18+00:00","updated_at":"2026-11-07T06:48:18+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T06:48:18Z","model":"claude-haiku-5-5","output":{"fix":"- Magic Link plugin: move to `2.2.6` or later.","reach":"internet","title":"Magic Link WordPress plugin: any logged-in user can log in as admin","impact":"high","summary":"The Magic Link WordPress plugin before 2.2.6 does not verify that a user requesting a login link is allowed to create one for a chosen account. Any authenticated user, including a subscriber, can generate a working login link for an administrator and sign in as that administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","magic-link-plugin"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker logs in as an administrator and takes over the WordPress site","analyst_note":"Confirm the affected version range and whether the fix is in 2.2.6 using the plugin's changelog or the WordPress plugin directory, since the sources here only give the 'before 2.2.6' wording.","how_to_check":"- Check the installed version of the Magic Link plugin in the WordPress admin under Plugins; versions below `2.2.6` are affected.\n- Review WordPress user accounts for unexpected administrator logins or new admin users.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-2.2.6-or-later","no-user-accounts"],"who_is_affected":"Sites running the Magic Link WordPress plugin before version 2.2.6 that allow user accounts to exist with low privileges, such as subscribers. Attackers need a logged-in account of any role, so sites with open registration are at higher risk. Sites without the plugin or already on 2.2.6 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4204,"output_tokens":620,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121848':17A,20A '-2026':16A,19A '2.2.6':33B,80C 'account':52B,99C 'admin':14A 'administr':67B,73B,116C 'allow':45B,100C 'authent':54B,102C 'authoris':92C 'check':83C 'chosen':51B,98C 'creat':47B 'cve':15A,18A 'generat':60B,94C,109C 'includ':56B 'link':2A,23B,29B,43B,64B,76C,90C,113C 'log':7A,11A,118C 'logged-in':6A 'login':42B,63B,89C,112C 'magic':1A,22B,28B,75C 'magic-link-plugin':21B 'one':48B,95C 'packag':25B 'plugin':4A,24B,31B,78C 'request':40B,87C 'sign':69B 'subscrib':58B,107C 'user':9A,39B,55B,86C,103C 'verifi':36B 'wordpress':3A,26B,30B,77C 'work':62B,111C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Magic Link WordPress plugin before version 2.2.6 that allow user accounts to exist with low privileges, such as subscribers. Attackers need a logged-in account of any role, so sites with open registration are at higher risk. Sites without the plugin or already on 2.2.6 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","magiclinkplugin","package","wordpress"],"campaign_type":null,"search_a":"'-121848':17A,20A '-2026':16A,19A 'admin':14A 'cve':15A,18A 'link':2A 'log':7A,11A 'logged-in':6A 'magic':1A 'plugin':4A 'user':9A 'wordpress':3A","search_b":"'2.2.6':33B 'account':52B 'administr':67B,73B 'allow':45B 'authent':54B 'chosen':51B 'creat':47B 'generat':60B 'includ':56B 'link':23B,29B,43B,64B 'login':42B,63B 'magic':22B,28B 'magic-link-plugin':21B 'one':48B 'packag':25B 'plugin':24B,31B 'request':40B 'sign':69B 'subscrib':58B 'user':39B,55B 'verifi':36B 'wordpress':26B,30B 'work':62B","search_c":"'2.2.6':80C 'account':99C 'administr':116C 'allow':100C 'authent':102C 'authoris':92C 'check':83C 'chosen':98C 'generat':94C,109C 'link':76C,90C,113C 'log':118C 'login':89C,112C 'magic':75C 'one':95C 'plugin':78C 'request':87C 'subscrib':107C 'user':86C,103C 'wordpress':77C 'work':111C","first_public_at":"2026-11-07T06:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121848","severity":null,"published_at":"2026-11-07T06:16:58+00:00","modified_at":"2026-11-07T06:16:58+00:00","first_seen_at":"2026-11-07T06:46:04+00:00","fetched_at":"2026-11-07T06:46:04+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}