CVE-2026-86710 — Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter

CVE-2026-86710

Description (CNA)

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.

Affected (CNA)

Vendor / product	Versions
Unknown / Login with QR	affected 0 through 1.0.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/d37dab2e-b137-4ad7-ab07-9c36b42a6485/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.