Login With Qr
Monthly
Unauthenticated attackers can log in as any user, including administrators, in the WordPress plugin Login with QR through version 1.0.0 because it fails to verify that the QR login code was issued by the plugin, instead matching any stored user metadata value. This critical authentication bypass (CVSS 9.8) requires no authentication or user interaction and is remotely exploitable against default configurations, with publicly available exploit code but no confirmation of active exploitation in the wild. The plugin must be installed and active for exploitation, but its niche deployment footprint is the only limiting factor.
Unauthenticated attackers can log in as any user, including administrators, in the WordPress plugin Login with QR through version 1.0.0 because it fails to verify that the QR login code was issued by the plugin, instead matching any stored user metadata value. This critical authentication bypass (CVSS 9.8) requires no authentication or user interaction and is remotely exploitable against default configurations, with publicly available exploit code but no confirmation of active exploitation in the wild. The plugin must be installed and active for exploitation, but its niche deployment footprint is the only limiting factor.