Magic Link – Secure one click passwordless login
Magic Link – Secure one click passwordless login has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of November 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Improper Privilege Management, behind 1 of the records (100%).
The one issue recorded for Magic Link – Secure one click passwordless login has a vendor fix available, so running the current release closes it.
All of these findings were reported by Muni Nitish Kumar Yaddala. Magic Link – Secure one click passwordless login is installed on roughly 30 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.
CVE-2026-121848Magic Link <= 2.2.5 - Authenticated (Subscriber+) Privilege Escalation
Read the full analysisVulnerability Records

Magic Link – Secure one click passwordless login
Author
KaizenCoders
Say goodbye to forgotten passwords. Enable a secure, passwordless login experience for your WordPress site using email, SMS, or QR code magic links. Magic Link makes traditional passwords a thing of the past. Instead of logging in with a username and password, users can log in simply by clicking a secure link sent to their email or phone. It’s quick, safe, and incredibly user-friendly. Perfect for membership sites, WooCommerce stores, community forums, or any site that wants to simplify user authentication. Core Benefits 👉 Passwordless Login No more password resets or weak password risks. 👉 Email Magic Links A unique, expirable login link is emailed to users. 👉 Force Magic Link Login Option to set Magic Link the default login method. 👉 Auto-login Links Automatically log in users via links in notification emails for quicker actions. 👉 User-Friendly UX Especially helpful for non-technical users or mobile-first visitors. 👉 Redirect After Login Send users to a specific page after they log in. 👉 Create Magic Link for any user Admin can create Magic Link for any user. 👉 List All Magic Links Admin can view all generated Magic Links. 👉 Bulk Delete Magic Links Select multiple Magic Links and delete in bulk. 👉 Shortcode Support Add magic link login forms anywhere on your site with [magic-link]. 👉 Login & Email Branding Set your own logo, brand colour, and custom CSS under Magic Link → Settings → Branding, and they apply to both the WordPress login screen and the magic link email. 👉 Login Form Block Drop a Magic Link Login Form block onto any page in the block editor. Choose whether new visitors can register, where they land after login, and what the button says — no shortcode or code required. 👉 Audit Log Every magic link event — generated, sent, opened, used, expired, revoked, failed — is recorded and browsable under Magic Link → Audit Log, with filtering and search. 👉 Health Check A Magic Link → Health page that verifies email sending, database tables, scanner protection, and token lifespan, so you can spot a misconfiguration before your users do. 👉 Dashboard & Email Digest See magic link activity at a glance and receive a periodic summary by email. 👉 Customizable Expiry Set how long magic links remain valid (minutes, hours, days). 👉CLI Ready Control plugin settings and features via WP-CLI. 👉 Fully Configurable [Coming Soon] Export/import/reset settings with ease. 👉 GDPR Compliant No personal data is stored beyond what WordPress already collects. 🔐 Pro Features 👉 Login URL Redirection Redirect users to specific pages after login 👉 Role based redirection Redirect users to specific pages after login 👉 Login Attempt Limits Set limits on magic link generation 👉 Custom Email Templates Customize email design and content. 👉 Improved Security Avoid brute-force attacks and phishing risks related to password use. 👉 IP Control Enhance the security by restricting users to login from the same IP address that requested the link. 👉 Login Request Throttling Limit login URL generation for the given time span. 👉 Brute Force Protection Limit rate of login attempts and block IP temporarily. 👉 Domain Restriction Restrict email domains that can use the magic link login feature. 👉 Trusted Domains Allow users with email addresses from specified trusted domains to receive Magic Links even if they don’t have a user account on the site. 👉 Bulk Actions: Expire, Used Links Mark Magic Links as Expired, Used in bulk. 👉 Support {magic-link} merge tag One can use {magic-link} merge tag in outgoing emails to auto generate Magic Link for the recipient. Useful for quick checkout, quick access to courses and other usecases where login is required. 👉 REST API Generate, look up, and revoke magic links from your own app, mobile client, or automation tool. Secured with WordPress application passwords. 👉 Outbound Webhooks Get a signed HTTP callback whenever a magic link is generated, sent, opened, used, expired, or revoked. Connect to Zapier, n8n, or your own service. Manage endpoints from Magic Link → Webhooks with a built-in Test Fire button. 👉 Bulk Account Claim Emails Select any number of users on the Users screen and send them all a magic link in one action. Ideal for migrating an existing member list onto passwordless login, or re-activating people who have never logged in. Users who have signed in recently are skipped automatically. 👉 Access Control Restrict when a magic link works by date range, weekday, and hour of day, and limit logins to specific IP ranges or CIDR blocks. Configure it all under Magic Link → Settings → Security → Access Control. 👉 Usage Limits Decide how many times a single magic link may be redeemed when you create it. Set 0 for an unlimited link, or a higher number to share one link with a small group. 👉 Step-Up Authentication [Coming Soon] Ask for an authenticator app code or an emailed one-time PIN when a login looks risky, and let people mark a device as trusted to skip the challenge. 👉 Form Builder Integrations Use the {magic-link} tag in your WPForms, Gravity Forms, or Fluent Forms notifications and it becomes a passwordless login link for the recipient. Switch each builder’s integration on under Magic Link → Settings → Integrations, tick the forms that may use the tag, or flip the toggle inside the form builder itself. Switching an integration off pauses every form for that builder without forgetting your choices. 👉 SMS Magic Links [Coming Soon] Send login links via SMS text messages. 👉 QR Code Login [Coming Soon] Generate QR codes for easy mobile login. 👉 Device Restrictions [Coming Soon] Limit logins to specific devices/browsers. 👉 Role-Based Access [Coming Soon] Control which user roles can use magic links. 👉 Analytics & Reporting [Coming Soon] Track magic link usage and patterns. 👉 Priority Support Get expert help when you need it. Integrations Every integration below detects its plugin automatically and stays completely inactive when that plugin is not installed, so you can enable only what you use without any risk to the rest of your site. 👉 WooCommerce Seamless checkout experience for returning customers. 🔐 Membership & LMS (Pro) 👉 MemberPress Members get a one-click login link in their MemberPress emails and as soon as a transaction completes — no password needed to reach the content they just paid for. 👉 Paid Memberships Pro Magic links in PMPro emails and straight after checkout, so new members land inside their membership area instead of on a login form. 👉 LearnDash Course, lesson, and enrolment notification emails carry a magic link that drops the learner directly into the course. 👉 LifterLMS Magic links in LifterLMS notification emails, including a {magic_link} merge code you can place in your own templates. 👉 Tutor LMS Magic links in Tutor LMS notification emails for frictionless course access. 🔐 Form Builders (Pro) 👉 WPForms, Gravity Forms & Fluent Forms Put {magic-link} in a form’s notification email and it is replaced with a passwordless login link for whoever receives it. Useful for request-access forms, event sign-ups, and support forms that should hand someone a way back into their account. Only forms you tick may use the tag, so installing PRO never changes what your existing forms do. 🔐 Commerce, CRM & Community (Pro) 👉 Easy Digital Downloads Buyers get a magic link in their purchase emails and can reach their downloads without hunting for a password. 👉 WooCommerce Subscriptions Resolves {magic_link} in subscription emails so renewal and status notices link straight into the customer’s account. 👉 FluentCRM Magic link activity is written back to the contact record as a note, so your CRM timeline shows how each contact is actually logging in. 👉 WP Fusion Pushes magic link activity to whichever CRM you have connected through WP Fusion. 👉 bbPress Forum and topic subscription emails include a magic link, so members can jump straight into the discussion and reply. How It Works A user enters their email address on the login screen. A one-time, time-sensitive login link is emailed to them. They click the link and are instantly logged into your site — no password needed! Translations Does Magic Link speak your language? If not, translate “Magic Link” into your language. DO YOU HAVE ANY QUESTIONS/ FEEDBACK/ FEATURE REQUEST/ BUG REPORT❓ Feel free to create a ticket here. We love to communicate with you and reply to all your queries. Spread The Word ❤️ If you like Magic Link, please leave us a ⭐⭐⭐⭐⭐ review and also spread the word about it via Facebook and Twitter. That helps fellow website owners assess Social Linkz easily and benefit from it! What’s Next If you like this plugin then consider checking out our other solutions: URL Shortify – Simple, Powerful, and Easy URL Shortener Plugin For WordPress. URL Shortify helps you beautify, manage, and share any URL on or off of your WordPress website. Create links that look how you want using your domain name! It’s a Simple, Easy & Elegant self hosted alternative to Bitly, TinyURL, Cuttly, Pretty Links, URL Shortener By My Theme Shop, Rebrandly, BL.Link, Short.io, and many other SaaS URL Shortener services. Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress. If you move your WordPress website to a new domain name, you will find that internal links to pages and references to images are not updated. Instead, these links and references will point to your old domain name. Update URLs fixes that problem by helping you change old urls and links in your website. Logify Logify is a comprehensive logging and monitoring plugin for WordPress that helps you keep track of various activities and events on your website. It provides detailed logs of user actions, system events, and errors, allowing you to monitor and troubleshoot your site effectively. Social Linkz – Lightweight and fast social media sharing plugin UtilityKit UtilityKit is a powerful and versatile WordPress plugin that provides a collection of essential tools and features to enhance your website’s functionality. It includes a variety of utilities such as show/hide admin bar, disable comments, enable/disable WordPress debug log and see logs inside WordPress admin and many more. All designed to improve user experience and streamline website management. It’s a simple & neat plugin which helps you to customize your WordPress setup in a very elegant way.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C