CVE-2026-121848: Magic Link < 2.2.6 - Subscriber+ Privilege Escalation via Magic Link Generation

Q: Who can exploit this issue?

Any authenticated WordPress user can exploit it, including a user with only the Subscriber role. The attacker must be able to request a Magic Link login link through the affected plugin.

Q: What access can an attacker gain?

An attacker can generate a working login link for an administrator account and use it to log in as that administrator. This can result in full administrative access to the WordPress site.

Q: How can I tell whether the site is vulnerable?

Sites using the Magic Link WordPress plugin before version 2.2.6 are affected. A proof of concept is flagged as available.

Published Nov 7, 2026

Updated

The Magic Link WordPress plugin before 2.2.6 does not check that the user requesting a login link is authorised to generate one for the chosen account, allowing any authenticated user, such as a subscriber, to generate a working login link for an administrator and log in as them.

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated WordPress user can exploit it, including a user with only the Subscriber role. The attacker must be able to request a Magic Link login link through the affected plugin.

What access can an attacker gain?

An attacker can generate a working login link for an administrator account and use it to log in as that administrator. This can result in full administrative access to the WordPress site.

How can I tell whether the site is vulnerable?

Sites using the Magic Link WordPress plugin before version 2.2.6 are affected. A proof of concept is flagged as available.

CVE-2026-121848: Magic Link < 2.2.6 - Subscriber+ Privilege Escalation via Magic Link Generation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain?

How can I tell whether the site is vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain?

How can I tell whether the site is vulnerable?