EUVD-2026-96761
GHSA-78rw-wp89-q5cq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with vulnerable plugin
-
DeliverySend crafted login request with forged value
-
ExploitPlugin skips session validation
-
ExecutionReceive administrator session
-
ImpactFull site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the plugin installed - the flaw is remotely and unauthenticatedly exploitable (AV:N/AC:L/PR:N/UI:N) against any WordPress site running Mindstien Quick Login version 1.0 or earlier where the plugin is configured with an administrator account for its quick-login feature. The specific prerequisite drawn from the description is that the plugin must be configured/active with a target administrator account, since the attacker gains a session as 'the administrator account the plugin is configured with.' Limiting factors: exploitation is confined to sites that have actually installed and activated this specific, low-footprint plugin; there is no default-WordPress exposure. No authentication, no user interaction, and no non-default server configuration are required. |
| Impact | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no privileges and no user interaction, and the impact (C:H/I:H/A:H) is consistent with the description: an unauthenticated attacker obtains a working session as the configured administrator account, which is effectively a full site takeover. CWE-287 (Improper Authentication) aligns precisely with the described failure to validate a request-supplied value against the visitor's own session. Exploitation signal is reinforced by publicly available exploit code reported by WPScan, so the barrier to abuse is low. However, no EPSS probability score was provided in the input, so exploitation-likelihood cannot be quantified, and the vulnerability is NOT listed in CISA KEV - meaning there is no confirmation of active in-the-wild exploitation despite the public POC (POC availability and active exploitation are distinct signals). No SSVC decision data was supplied. Net: treat as urgent-to-patch for any site running this plugin given the trivial, unauthenticated admin-takeover primitive and public exploit, while noting that real-world mass-exploitation evidence (KEV/EPSS) is absent from the available data. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a WordPress site running Mindstien Quick Login (≤1.0) containing a value the plugin fails to validate against the requester's actual session. The plugin authenticates the request as the configured administrator, handing the attacker a valid admin session over the network with no credentials or user interaction. Public exploit code reported by WPScan exists, lowering the skill required to carry this out. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Authentication bypass in the Mindstien Quick Login WordPress plugin through version 1.0 allows unauthenticated remote attackers to obtain an administrator session on any affected site where the plugin is active and configured with an administrator account. The flaw (CWE-287) stems from the plugin failing to validate a request-supplied value against the visitor's own session before authenticating them, yielding a CVSS 3.1 base score of 9.8. Publicly available exploit code exists, and while the vulnerability is not confirmed as actively exploited (CISA KEV), the low attack complexity and lack of required authentication make immediate remediation critical.
RemediationAI
No vendor-released patch identified at time of analysis. The most reliable remediation is to deactivate and completely remove the Mindstien Quick Login plugin from all WordPress installations, as the authentication bypass is inherent to its logic and no fixed version is currently available. If removal is not immediately possible, reconfigure the plugin's quick-login feature to target a non-administrator, least-privileged account to reduce the impact of a session hijack, though the authentication bypass itself would remain exploitable. Additional compensating controls include blocking requests to the plugin's endpoint(s) at the web application firewall or reverse proxy layer (temporary and may require tuning), and monitoring WordPress audit logs for unexpected administrator logins originating from unfamiliar IP addresses. Because publicly available exploit code exists, prioritize this action; consult the WPScan advisory at https://wpscan.com/vulnerability/648d461c-6610-4566-a310-b02187d68cc9/ for ongoing updates and any future patched release. Note that deactivating the plugin will remove its intended quick-login functionality, and WAF rules may be bypassed if the plugin exposes alternate request paths.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability resides in a WordPress plugin, Mindstien Quick Login, which provides a streamlined authentication feature. The plugin accepts a value from an incoming request and uses it to authenticate the visitor without first verifying that the value corresponds to the visitor's own session or a legitimate authentication token. This failure to bind the authentication decision to the current user's session is a classic instance of CWE-287 (Improper Authentication), enabling an attacker to bypass the normal WordPress login process and assume the identity of the administrator account pre-configured within the plugin. The CPE entry cpe:2.3:a:unknown:mindstien_quick_login:*:*:*:*:*:*:*:* indicates that the vendor is unclassified and that all versions up to and including 1.0 are affected. No default WordPress exposure exists; exploitation requires the plugin to be installed, activated, and configured with an administrator account.
Know when Mindstien Quick Login gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network request bypasses session validation to gain an admin session (PR:N, AC:L, AV:N), yielding full admin control and thus high confidentiality, integrity, and availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.
Technical POC Analysis
Bug class: CWE-287, Broken Authentication / Authentication Bypass.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A critical authentication bypass in the Mindstien Quick Login WordPress plugin (through version 1.0) allows an attacker to seize a full administrator session on any site where the plugin is installed and configured with an administrator account, exposing complete control of site content, user data, and any integrated business systems. Because public exploit code is circulating, a working method to compromise affected sites is already within reach of low-skill attackers, and no vendor patch is currently available. Any business unit relying on WordPress sites running this plugin - customer-facing, marketing, or e-commerce - should treat this as an immediate containment priority rather than a routine patch cycle item.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate and remove the Mindstien Quick Login plugin (through version 1.0) from all sites; block access to the plugin's authentication endpoints at the WAF or reverse proxy; restrict wp-login.php/wp-admin to trusted IP ranges or VPN; enforce multi-factor authentication and strong unique credentials for administrator accounts; rotate administrator credentials and invalidate active sessions; monitor for unauthorized administrator account creation, privilege changes, and anomalous login patterns; preserve logs for forensic review.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB