CVE-2026-84734: Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter

Q: Who can exploit this issue?

Any unauthenticated attacker can exploit it if the affected plugin is configured with an administrator account. No prior login is required.

Q: What access could an attacker gain?

An attacker can obtain an authenticated session as the administrator account configured in Mindstien Quick Login, giving them that account's administrative access.

Q: Which plugin versions are affected?

Mindstien Quick Login versions through 1.0 are affected.

Published Oct 11, 2026

Updated

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.

Affected Software

1 affected component

Mindstien Quick Login<=1.0

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated attacker can exploit it if the affected plugin is configured with an administrator account. No prior login is required.

What access could an attacker gain?

An attacker can obtain an authenticated session as the administrator account configured in Mindstien Quick Login, giving them that account's administrative access.

Which plugin versions are affected?

Mindstien Quick Login versions through 1.0 are affected.

CVE-2026-84734: Mindstien Quick Login <= 1.0 - Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker gain?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker gain?

Which plugin versions are affected?