CVE-2026-86710 Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators...

CVE-2026-86710

The Login with QR WordPress plugin (versions through 1.0.0 ) suffers from an unauthenticated authentication bypass via the autologin_code parameter. The plugin fails to verify that a submitted login code was actually issued by itself, instead matching it against any stored user metadata value. Th...