Executive Summary
A critical vulnerability (CVE-2026-13597) with a CVSS score of 9.1 was discovered in the 微信二维码登陆 WordPress plugin through version 1.3. This vulnerability allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.
Technical Analysis
The vulnerability class is an improper validation of webhook requests, specifically a failure to properly validate WeChat webhook requests. The attack vector involves an unauthenticated attacker sending a forged webhook request to the vulnerable plugin. The root cause is the plugin's signature check always passing, and it discloses the generated login code in the webhook response.
How It Gets Exploited
An unauthenticated remote attacker sends a forged webhook request to the vulnerable 微信二维码登陆 plugin. The request triggers the plugin's login event generation, which discloses the login code in the response. The attacker then reads the login code and uses an unauthenticated AJAX action to redeem it, effectively logging in as the targeted user without a password. This can lead to the attacker gaining administrative access if the targeted user has such privileges.
Impact Assessment
The 微信二维码登陆 WordPress plugin version 1.3 and earlier are affected. An attacker can achieve unauthorized login as any user, including administrators, potentially leading to full site compromise. The CVSS score of 9.1 indicates a critical severity level, with high impacts on confidentiality and integrity.
Recommended Actions
- Update the 微信二维码登陆 plugin to a version later than 1.3.
- Implement a Web Application Firewall (WAF) rule to detect and block suspicious webhook requests.
- Monitor for unusual login attempts and webhook requests.
- Consider temporarily disabling the plugin until an update is applied.
Sources
- National Vulnerability Database (NVD)
- WPScan