9.8
Critical
CVE-2026-86710 The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued,…
Description
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Login with QR 1.0 | earliest → 1.0.0 | No fix stated |