Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-84734: Mindstien Quick Login lets attackers log in as admin
CVE-2026-84734 · published 5 days ago
Summary
The Mindstien Quick Login plug‑in for WordPress does not properly check a value it receives, so anyone can send a special request and gain the site’s administrator session. This gives an unauthenticated user full control of the website. Remove or replace the plug‑in, or apply the vendor’s update that corrects the validation, and change all admin passwords immediately.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | mindstien quick login | <= 1.0 |
Original advisory text
Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-287Improper Authentication
Timeline
Published11 Oct 2026
Updated15 Oct 2026
First seen11 Oct 2026
Track software like this
Free during beta