WordPress QR Login Plugin Fails to Verify Authentication Codes

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead, which allows unauthenticated attackers to log in as any user, including administrators.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Login with QR WordPress plugin through version 1.0.0 contains a critical authentication bypass vulnerability (CVE-2026-86710, CVSS 9.8) that allows unauthenticated attackers to assume any user identity, including administrators. Rather than validating that QR codes match codes the plugin itself generated, the plugin accepts any value that matches stored user metadata—a fundamental failure in authentication logic. This affects all WordPress sites running the vulnerable plugin version, creating immediate risk for account takeover, data theft, and malicious administrative actions. The vulnerability is particularly dangerous because it requires no special tools or knowledge; attackers can craft simple QR codes to gain unauthorized access.

Casky's 283 mapped skills detect the attack patterns underlying this vulnerability by analyzing indicators across MITRE ATT&CK's Initial Access (TA0004) and Credential Access (TA0006) tactics. Practitioners using Casky would identify suspicious patterns such as: authentication events without corresponding QR code generation logs, metadata value mismatches in user sessions, administrative account access from unexpected sources, and rapid sequential login attempts using varying QR code values. Claude's extended reasoning capabilities correlate these signals across security logs to reveal the characteristic fingerprint of this bypass—successful authentication paired with absent or mismatched cryptographic verification records. Security teams would see findings highlighting improper credential validation mechanisms and unauthenticated access chains, enabling rapid detection of exploitation attempts before attackers establish persistent admin access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-86710.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-86710

Casky has 283 skills that investigate the attack patterns behind CVE-2026-86710. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn