PT-2026-8055 · WordPress · Magic Login Mail/Qr Code

Ifoundbug · Publicado 2026-02-14 · Atualizado 2026-02-14 · CVE-2026-2144

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Magic Login Mail or QR Code plugin for WordPress versions up to and including 2.05

Description The plugin is susceptible to a privilege escalation issue. This is caused by the plugin storing the magic login QR code image with a predictable filename (QR Code.png) in a publicly accessible directory during email sending. The file is deleted after the email function completes, creating a race condition. This allows unauthenticated attackers to request a login link for any user, including administrators, and exploit the timing gap to obtain the login URL encoded in the QR code, leading to unauthorized account access.

Recommendations Versions prior to and including 2.05 should be updated.

Correção

LPE

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2026-2144

Produtos afetados

Magic Login Mail/Qr Code

Referências · 9

• https://wordfence.com/threat-intel/vulnerabilities/id/65066a17-653b-4444-9bd0-894ea8c1acb1?source=cve · Nota
• https://t.me/CVEtracker/44693 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/magic-login-mail/trunk/lib/class-magicloginmail.php#L325 · Nota
• https://plugins.trac.wordpress.org/browser/magic-login-mail/trunk/lib/class-magicloginmail.php#L250 · Nota
• https://twitter.com/TheHackerWire/status/2022541032240611509 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2022673851596050570 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3460417 · Nota
• https://twitter.com/CVEnew/status/2022543944953766014 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2144 · Nota de Segurança