Authentication Bypass in Login with QR Plugin for WordPress
CVE-2026-86710
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 17 September 2026
Badges
What is CVE-2026-86710?
The Login with QR plugin for WordPress, up to version 1.0.0, is susceptible to an authentication bypass vulnerability. This flaw allows unauthenticated users to log in as any user, including those with administrative privileges, without the need for proper authentication. The plugin fails to validate that the login code issued is authentic, instead matching any stored user metadata value. As a result, attackers can exploit this weakness to compromise user accounts, leading to unauthorized access and potentially significant security risks for WordPress sites utilizing this plugin.
Affected Version(s)
Login with QR 0 <= 1.0.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.