Privilege Escalation in Magic Login Mail or QR Code Plugin for WordPress

CVE-2026-2144

What is CVE-2026-2144?

The Magic Login Mail or QR Code plugin for WordPress presents a vulnerability that allows for privilege escalation due to the improper handling of a magic login QR code image. All versions up to and including 2.05 are affected, as the plugin stores the QR code with a predictable filename in the publicly accessible uploads directory. This creates a race condition between the creation and deletion of the QR code file, allowing unauthorized users to exploit this flaw. By initiating a login link request for any user, an attacker can intercept the QR code and obtain an encoded login URL, potentially granting them access to another user's account, including administrators.

References