Login with QR CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL Login with QR CVE published 2026-09-17

CVE-2026-86710

The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored user metadata value instead. This allows unauthenticated attackers to log in as any user, including administrators, potentially leading to unauthorized access and lateral movement within WordPress installations. Defenders should assess exposure and prioritize remediati [truncated]