CVE-2026-13597
QRcode Login for WeChat <= 1.3 - Unauthenticated Account Takeover
- State
- Published
- Severity
- 9.1 Critical
- Published
- Jul 27, 2026
- Updated
- Jul 27, 2026
- Reserved
- Jun 29, 2026
Description
The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
微信二维码登陆Unknown |
|
References
- https://wpscan.com/vulnerability/5e856219-ece5-4d79-8375-fc0cbdc37d6c/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.