A critical authentication bypass vulnerability in the Login with QR WordPress plugin allows unauthenticated attackers to gain full administrative access to affected sites.

This flaw stems from improper authentication (CWE-287) where the plugin fails to verify the authenticity of login tokens. An unauthenticated attacker can exploit this by providing arbitrary metadata values, effectively bypassing the login process to assume the identity of any registered user.

The ability for an unauthenticated attacker to assume administrative control presents a total compromise of the affected WordPress environment. This risk is reflected in the CVSS score of 9.8, indicating that the vulnerability is highly automatable and poses an immediate threat to data confidentiality, integrity, and availability. Successful exploitation could lead to full site takeover, data exfiltration, or the distribution of malicious payloads to site visitors.

Immediate Action: Since a specific patch version is currently unavailable, administrators should immediately deactivate and remove the Login with QR plugin from all WordPress installations.

Proactive Monitoring: Review web server access logs for anomalous authentication requests, particularly those originating from unknown IP addresses targeting login-related endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious traffic patterns associated with authentication bypass attempts, though removal of the plugin remains the only definitive mitigation.

Public Exploit Available: Unknown.

Given the critical nature of this authentication bypass and the potential for total system compromise, immediate removal of the vulnerable plugin is mandatory. Organizations must prioritize the audit of user accounts for any unauthorized activity during the period the plugin was active, as attackers may have already established persistent backdoors or elevated privileges.