VentraConnect WordPress Plugin OTP Brute Force Enables Unauthenticated Administrator Account Takeover (CVE-2026-13142)

Scope: Social Login, Passkeys, Magic Link and Email OTP WordPress Plugin (VentraConnect) Versions Prior to 1.4.1

Severity: Red

A critical account takeover vulnerability in the VentraConnect WordPress plugin stems from two compounding design failures: the plugin stores numeric OTP codes in plaintext and enforces no rate limiting or lockout on the email OTP verification endpoint, meaning any unauthenticated attacker who knows a registered email address including an administrator's can simply cycle through the small numeric OTP keyspace in an automated brute-force attack, bypassing the passwordless login entirely and gaining full administrator access to the WordPress site. Because administrator email addresses are frequently disclosed through contact pages, WHOIS records, or previous data breaches, the "knowledge of a registered email" prerequisite presents a very low barrier to exploitation. Organizations running WordPress sites with VentraConnect installed must update to version 1.4.1 immediately, deploy a WAF with brute-force rate limiting on the OTP verification endpoint as a defense-in-depth measure, and audit user accounts for any unauthorized administrator additions that may indicate prior exploitation.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.