critical9.8
CVE-2026-86710
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value …
Impact
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
Affected products
| Product | Affected versions |
|---|---|
| Login With QR WordPress Plugin | through 1.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.