CVE-2026-86710: Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter

Q: Who can exploit this issue?

Any unauthenticated attacker can exploit it remotely. The issue can allow login as any user account, including administrator accounts.

Q: What does an attacker need to provide to bypass authentication?

The attacker needs to supply an autologin_code parameter value that matches a stored user metadata value. The plugin does not verify that the code was issued by the plugin.

Q: Are administrator accounts affected?

Yes. An attacker may be able to log in as any user, including an administrator, if they can provide a matching stored metadata value.

Published Sep 17, 2026

Updated

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.

Affected Software

1 affected component

WordPress Login with QR<=1.0.0

Event History

Sep 17, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated attacker can exploit it remotely. The issue can allow login as any user account, including administrator accounts.

What does an attacker need to provide to bypass authentication?

The attacker needs to supply an autologin_code parameter value that matches a stored user metadata value. The plugin does not verify that the code was issued by the plugin.

Are administrator accounts affected?

Yes. An attacker may be able to log in as any user, including an administrator, if they can provide a matching stored metadata value.