CVE-2026-86710 — Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which all…
Published: 2026-09-17 · CVSS: 9.8 · CVSS 3.1
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7