CVE-2026-13597
The WeChat QR code login WordPress plugin (v1.3) fails to validate webhook requests, allowing attackers to forge login events and obtain login codes. An attacker can then use those codes to log in as any user, including administrators, without needing a password. This flaw is critical because it gives full access to the site.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites using the WeChat QR code login plugin, version 1.3.
Real-world impact
An attacker can create a fake login event for any existing user, capture the login code, and then redeem it to gain unauthorized access to that user's account, including admin privileges, without knowing the password.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability is exploitable over the network (AV:N), requires no authentication (PR:N), and has no user interaction (UI:N). It allows complete compromise of confidentiality and integrity for the affected user accounts, but does not affect availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources