CVE-2025-1717

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1717", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-26T15:43:02.736Z", "datePublished": "2025-02-27T07:23:13.273Z", "dateUpdated": "2026-04-08T17:34:46.312Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:46.312Z"}, "affected": [{"vendor": "pluginly", "product": "Login Me Now \u2013 Passwordless, Magic Link, OTP & Social Login for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.7.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the 'AutoLogin::listen()' function. This makes it possible for unauthenticated attackers to log in an existing user on the site, even an administrator. Note: this vulnerability requires using a transient name and value from another software, so the plugin is not inherently vulnerable on it's own."}], "title": "Login Me Now <= 1.7.2 - Authentication Bypass", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fc689622-50d6-47c4-a5f6-0314b1a207c9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/login-me-now/tags/1.7.2/app/Logins/BrowserTokenLogin/AutoLogin.php#L24"}, {"url": "https://plugins.trac.wordpress.org/changeset/3247924/login-me-now"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "cweId": "CWE-288", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2025-02-26T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-02-26T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-02-26T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-27T14:38:18.277150Z", "id": "CVE-2025-1717", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-27T14:38:26.954Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1717", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-27T14:38:18.277150Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-27T14:38:22.248Z"}}], "cna": {"title": "Login Me Now <= 1.7.2 - Authentication Bypass", "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "pluginly", "product": "Login Me Now \u2013 Passwordless, Magic Link, OTP & Social Login for WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.7.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-26T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-02-26T00:00:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-02-26T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fc689622-50d6-47c4-a5f6-0314b1a207c9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/login-me-now/tags/1.7.2/app/Logins/BrowserTokenLogin/AutoLogin.php#L24"}, {"url": "https://plugins.trac.wordpress.org/changeset/3247924/login-me-now"}], "descriptions": [{"lang": "en", "value": "The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the 'AutoLogin::listen()' function. This makes it possible for unauthenticated attackers to log in an existing user on the site, even an administrator. Note: this vulnerability requires using a transient name and value from another software, so the plugin is not inherently vulnerable on it's own."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:34:46.312Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1717", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:34:46.312Z", "dateReserved": "2025-02-26T15:43:02.736Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-02-27T07:23:13.273Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Login Me Now \u2013 Passwordless, Magic Link, OTP & Social Login for WordPress", "vendor": "pluginly", "versions": [{"lessThanOrEqual": "1.7.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pluginly:login_me_now:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "B33D8036-17F4-4D22-AF3A-C0FD0C95A9C4", "versionEndIncluding": "1.7.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication based on an arbitrary transient name in the 'AutoLogin::listen()' function. This makes it possible for unauthenticated attackers to log in an existing user on the site, even an administrator. Note: this vulnerability requires using a transient name and value from another software, so the plugin is not inherently vulnerable on it's own."}, {"lang": "es", "value": "El complemento Login Me Now para WordPress es vulnerable a la omisi\u00f3n de la autenticaci\u00f3n en versiones hasta la 1.7.2 incluida. Esto se debe a una autenticaci\u00f3n insegura basada en un nombre transitorio arbitrario en la funci\u00f3n 'AutoLogin::listen()'. Esto hace posible que atacantes no autenticados inicien sesi\u00f3n en un usuario existente en el sitio, incluso si es un administrador. Nota: esta vulnerabilidad requiere el uso de un nombre y un valor transitorios de otro software, por lo que el complemento no es inherentemente vulnerable por s\u00ed mismo."}], "id": "CVE-2025-1717", "lastModified": "2026-06-17T08:39:39.483", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1717", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-02-27T14:38:18.277150Z", "version": "2.0.3"}}]}, "published": "2025-02-27T08:15:31.130", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/login-me-now/tags/1.7.2/app/Logins/BrowserTokenLogin/AutoLogin.php#L24"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3247924/login-me-now"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fc689622-50d6-47c4-a5f6-0314b1a207c9?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-306"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:15:36.835246+00:00", "value": {"mitigation_remediation": ["Update the Login Me Now plugin to a patched version (1.7.3 or later) that addresses the authentication bypass.", "If an update is not available, disable the AutoLogin feature by removing or deactivating the AutoLogin.php component to eliminate the vulnerable entry point.", "Conduct a security audit of transient values on the site and any integrated applications to ensure no shared transient names could be leveraged by an attacker.", "Implement firewall or rate\u2011limiting rules around the AutoLogin endpoint to reduce the attack surface if the feature remains enabled temporarily."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Login Me Now plugin for WordPress from Pluginly, specifically versions 1.7.2 and earlier. Only WordPress sites running these versions are impacted; newer releases are not affected.", "description_and_impact": "An unauthenticated attacker can gain access to any existing WordPress user account, including administrators, by exploiting the Login Me Now plugin\u2019s insecure handling of transient names in the AutoLogin::listen() function. This authentication bypass gives the attacker control over the site, but the CVE entry does not describe further capabilities beyond the basic login.", "risk_and_exploitability": "The CVSS base score of 8.1 places the flaw in the high severity range. The EPSS score of less than 1% indicates a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves sending crafted requests to the AutoLogin endpoint that include a valid transient name and value from another application. This requires the attacker to obtain or guess a transient value associated with a different software component, so exploitation is not automated. Despite the low likelihood, the potential impact of unauthorized account takeover warrants prompt remediation."}}}}, "created": "2026-04-21T22:15:45.906563+00:00", "updated": "2026-04-21T22:15:45.906573+00:00", "vendors": []}