Privilege Escalation in Magic Login Mail or QR Code Plugin for WordPress

CVE-2026-2144

What is CVE-2026-2144?

The Magic Login Mail or QR Code plugin for WordPress presents a vulnerability that allows for privilege escalation due to the improper handling of a magic login QR code image. All versions up to and including 2.05 are affected, as the plugin stores the QR code with a predictable filename in the publicly accessible uploads directory. This creates a race condition between the creation and deletion of the QR code file, allowing unauthorized users to exploit this flaw. By initiating a login link request for any user, an attacker can intercept the QR code and obtain an encoded login URL, potentially granting them access to another user's account, including administrators.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References