The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Markchenlife |
|
| Wordpress |
|
No data.
No data.
References
History
Tue, 28 Jul 2026 21:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Markchenlife
Markchenlife qrcode-login-for-weixin Wordpress Wordpress wordpress |
|
| Vendors & Products |
Markchenlife
Markchenlife qrcode-login-for-weixin Wordpress Wordpress wordpress |
Mon, 27 Jul 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-287 | |
| Metrics |
cvssV3_1
|
Mon, 27 Jul 2026 06:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password. | |
| Title | QRcode Login for WeChat <= 1.3 - Unauthenticated Account Takeover | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: WPScan
Published: 2026-07-27T06:00:03.687Z
Updated: 2026-07-27T13:52:26.324Z
Reserved: 2026-06-29T07:36:53.053Z
Link: CVE-2026-13597
Vulnrichment
Updated: 2026-07-27T13:52:21.991Z
NVD
No data.
Redhat
No data.