CVE-2026-121848
The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the cho
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 7, 2026 · Last modified: Nov 7, 2026
Not enough EPSS history yet.
The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber, to generate a working login link for an administrator and log in as them.
No related CVEs by CWE or product.