WordPress QRcode Login for WeChat <= 1.3 Unauthenticated Account Takeover Vulnerability (CVE-2026-13597)

Vulnerability Overview Vulnerability Name: QRcode Login for WeChat <= 1.3 - Unauthenticated Account Takeover Description: The plugin fails to properly validate WeChat webhook requests because its signature check always passes and it exposes the generated login code. This allows unauthenticated attackers to forge login events, read the login code, and log in as that user (including administrators) without a password via unauthenticated AJAX operations. CVE ID: CVE-2026-13597 Classification: - Type: AUTHBYPASS - OWASP Top 10: A2: Broken Authentication and Session Management - CWE: CWE-287 - CVSS: 9.8 (Critical) Affected Versions Affected Plugin: qrcode-login-for-weixin Known Patch: None Remediation PoC Code: The page indicates that the PoC will be displayed after the issue is patched; therefore, no PoC code is currently available on this page. Additional Information Original Researcher: João Ramos Maciel Submitter: João Ramos Maciel Submitter Website: https://treesec.com.br/ Validation Status: Yes WPVDB ID: 5e856219-ece5-4d79-8375-fc0cbc37d6c Timeline: - Public Release Date: 2026-07-06 - Date Added: 2026-07-06 - Last Updated: 2026-07-24 Related Vulnerabilities 2013-03-24: Backupbuddy - importbuddy.php step Parameter Manipulation Authentication Bypass 2014-08-01: WordPress <= 3.0.5 wp-admin/press-this.php Privilege Escalation 2024-03-11: Hubbb Lite < 1.3.1 - Unauthenticated Password Protected Posts Access 2016-06-21: Advanced Access Manager <= 3.2.1 - Privilege Escalation 2025-09-18: Service Finder SMS System <= 2.0.0 - Authentication Bypass Summary This vulnerability affects the QRcode Login for WeChat plugin, posing a risk of unauthorized account takeover in versions 1.3 and below. Currently, there is no known fix available; users are advised to update as soon as possible or implement other security measures.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress QRcode Login for WeChat <= 1.3 Unauthenticated Account Takeover Vulnerability (CVE-2026-13597)

More from this source