8 matches found
PT-2026-98308
Alright, so I saw this Wordfence report from last week and honestly my jaw dropped. Nearly 50 plugins and themes dropped with active, unpatched vulnerabilities in a single week. That's not a normal week. That's a red flag waving right in our faces. And look, I get it. We all know the WordPress...
WordPress Login with QR plugin <= 1.0.0 - Unauthenticated Authentication Bypass vulnerability
Unauthenticated Authentication Bypass vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Login with QR versions = 1.0.0...
CVE-2026-86710
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...
CVE-2026-86710 Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...
CVE-2026-86710
The Login with QR WordPress plugin (versions
CVE-2026-86710 Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...
EUVD-2026-81341
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...
CVE-2026-86710: Improper Authentication
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...