WordPress WeChat QR Login Plugin Webhook Signature Bypass

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The 微信二维码登陆 WordPress plugin through version 1.3 contains a critical authentication bypass vulnerability affecting WordPress sites that implement WeChat-based login functionality. The plugin fails to properly validate WeChat webhook requests due to a signature check that always passes, combined with disclosure of login codes in webhook responses. This allows unauthenticated attackers to forge login events for any existing user account—including administrators—without requiring valid credentials. WordPress administrators using this plugin are immediately at risk of account takeover, with attackers able to gain full site control through a three-step attack: forge a webhook to trigger login, extract the login code from the response, and redeem it via an unprotected AJAX action.

Casky's Claude-powered analysis maps this vulnerability across 283 security skills, with particular focus on MITRE ATT&CK Technique TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would detect attack patterns including: malformed or unsigned webhook requests reaching the plugin endpoint, successful authentication events originating from non-WeChat sources, and AJAX calls to login redemption functions without proper session context. The extended reasoning capability identifies the chain of trust violations—unsigned webhook acceptance combined with code disclosure represents a broken authentication pattern (CWE-287). Security teams would see findings highlighting webhook endpoint abuse, suspicious login code generation tied to external requests, and the absence of cryptographic signature validation, enabling them to prioritize patching and implement compensating controls like IP whitelisting or Web Application Firewall rules.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13597.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-13597

Casky has 283 skills that investigate the attack patterns behind CVE-2026-13597. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn