Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-86710: Login with QR plugin lets attackers log in as anyone
CVE-2026-86710 · published 25 days ago
Summary
The Login with QR plugin for WordPress does not properly check the login code, so anyone can use it to sign in as any user, including administrators. This means an unauthorized person could gain full access to your site. Update the plugin to the latest version or remove it until a fix is released.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | login with qr | <= 1.0.0 |
Original advisory text
Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-287Improper Authentication
Timeline
Published17 Sep 2026
Updated11 Oct 2026
First seen17 Sep 2026
Track software like this
Free during beta