CVE-2025-3746 is a critical privilege escalation vulnerability affecting versions 2.0.14 to 2.0.59 of the OTP-less one tap Sign in plugin for WordPress. This flaw allows unauthenticated attackers to take over arbitrary user accounts, including administrators, by changing their email addresses and subsequently resetting passwords. The vulnerability stems from insufficient identity validation during user detail updates, and the plugin also exposes authentication cookies directly. With a CVSS score of 9.8 (CRITICAL), this vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. It requires no user interaction or privileges to exploit. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, which is typical for a large percentage of reported vulnerabilities.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Thedrifted | OTP-Less One Tap Sign In | >= 2.0.14, <= 2.0.59CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.