Description

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-17T06:16:51.437Z",
  "pubdate": "2026-09-17T06:16:51.437Z",
  "executiveSummary": "A critical authentication bypass vulnerability exists in the Login with QR WordPress plugin through version 1.0.0. The security flaw allows unauthenticated remote attackers to gain unauthorized access to any user account, including high-privilege administrator accounts, without requiring valid credentials. The issue stems from a fundamental failure in how the plugin validates authentication codes during the login sequence.\nBy exploiting this vulnerability, an attacker can completely compromise the affected WordPress website, gaining full administrative control. This enables malicious activities such as data theft, unauthorized content modification, installation of backdoors, and further propagation of attacks. Organizations using this plugin face severe risks to data confidentiality, system integrity, and service availability.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper verification logic implemented within the authentication handler of the Login with QR WordPress plugin. Specifically, when a user attempts to authenticate using a QR code, the plugin processes an associated login token or code. Rather than verifying that this code is a cryptographically signed, valid, and unexpired token issued explicitly by the application's backend for that specific session, the plugin compares the input against stored user metadata fields.\nBecause the plugin accepts any matching value stored within the user metadata table to authorize a session, an attacker can supply a value that matches an existing metadata attribute associated with a target user. This lack of strict validation allows the authentication mechanism to be easily subverted. The attack flow generally begins with an unauthenticated external actor targeting a specific user account, such as an administrator. The attacker submits a login request containing a code designed to trigger a match with the target user's metadata. Because the plugin does not restrict or validate the source of the token, it successfully matches the metadata, generates a session, and logs the attacker in with the target user's privileges.\nThis vulnerability requires no prior authentication or special privileges on the target system, and it is fully exploitable over the network. The impact of successful exploitation is a complete compromise of the application's access control, granting the attacker the exact privilege level of the hijacked account, up to and including administrative capabilities."
}