Executive brief
The Login with QR WordPress plugin is used to allow users to log into WordPress sites using QR codes. A critical vulnerability allows unauthenticated attackers to bypass authentication and log in as any user, including site administrators, by exploiting improper code validation in the login process. This could give attackers complete control over WordPress sites that use this plugin.
Technical details
The plugin contains an authentication bypass vulnerability (CWE-287) in how it validates QR code login attempts. Instead of verifying that the provided `autologin_code` parameter matches a code the plugin itself issued, it simply matches the value against any stored user metadata, allowing an attacker to provide an arbitrary string that happens to match a user's metadata value. No authentication is required and the attack is network-accessible. An unauthenticated attacker can exploit this to log in as any user by discovering or guessing valid metadata values. A patch was not yet available at time of publication.
Affected products
- WP Dev Login with QR through 1.0.0
Timeline
- 2026-09-15: disclosed
- 2026-09-17: advisory