Description
The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Login with QR | ≤ 1.0.0 | — |
References
- https://wpscan.com/vulnerability/d37dab2e-b137-4ad7-ab07-9c36b42a6485/ exploit vdb-entry technical-description