Introduction
Attackers can gain administrator access to WordPress sites running the OwnID Passwordless Login plugin if it is not fully configured. This critical flaw lets unauthenticated attackers log in on any affected site, which puts every user account at risk.
OwnID builds passwordless authentication for web platforms, including WordPress and WooCommerce. Its WordPress plugin was installed on only about 200 sites as of June 2024. The plugin is meant to improve security and user experience by removing passwords, but a critical flaw in its authentication logic has exposed those sites to account takeover.
Technical information
CVE-2025-10294 is an authentication bypass vulnerability in the OwnID Passwordless Login plugin for WordPress, affecting all versions up to and including 1.3.4. The cause is improper validation of the ownid_shared_secret configuration parameter during JWT (JSON Web Token) authentication.
Vulnerability mechanism:
- The plugin uses JWTs to authenticate users. In a secure implementation, JWTs are signed with a shared secret and verified on the server.
- In affected versions, the plugin does not check whether
ownid_shared_secretis empty before it validates JWTs. - If the shared secret is unset (which can happen when the plugin is installed but not fully configured), the plugin may accept any JWT, regardless of its signature.
- An attacker can then craft a JWT with arbitrary claims (such as an admin user ID) and present it to the authentication endpoint. The plugin will accept the token and log the attacker in as that user.
Root cause:
- The plugin is missing a validation step for the
ownid_shared_secretparameter. It should deny authentication when the secret is not set. Instead, it proceeds with JWT validation (or skips it), and authentication is bypassed. - The flaw is classified as CWE-288: Authentication Bypass Using an Alternate Path or Channel.
The referenced sources include no public code snippets or vulnerable code lines.
Affected systems and versions
- Product: OwnID Passwordless Login plugin for WordPress
- Affected versions: All versions up to and including 1.3.4
- Vulnerable configuration: Sites where the plugin is installed but
ownid_shared_secretis empty or unset (typically during or after incomplete configuration)
Vendor security history
- The OwnID Passwordless Login plugin has a history of severe bugs. Version 1.3.4 shipped with a critical issue that locked out all users (see WordPress support thread).
- Similar issues were reported in earlier versions (1.3.1, fixed in 1.3.2, then reintroduced in 1.3.4). That pattern suggests recurring problems with quality assurance and regression testing.
- As of this writing, there is no public evidence of a timely patch or a detailed vendor advisory for CVE-2025-10294.
