9.8
Critique
CVE-2026-86710 The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued,…
Description
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Login with QR 1.0 | premières → 1.0.0 | Pas de correctif indiqué |