CVE-2026-86710

Name of the Vulnerable Software and Affected Versions Login with QR versions prior to 1.0.1

Description The Login with QR WordPress plugin fails to verify if the authentication code used for login was actually issued by the system. Instead, it matches the code against any stored user metadata value, enabling unauthenticated attackers to bypass authentication and log in as any user, including those with administrator privileges, via the autologin code parameter.

Recommendations Update the plugin to a version later than 1.0.0.