PT-2026-64840 · WordPress · 微信二维码登陆

CVE-2026-13597 · Published 2026-07-27 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions 微信二维码登陆 WordPress plugin versions prior to 1.4

Description Insufficient validation of WeChat webhook requests occurs because the signature check always passes. Additionally, the plugin discloses the generated login code within the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, retrieve the login code, and use an unauthenticated AJAX action to log in as that user, including administrators, without requiring a password.

Recommendations Update the plugin to a version newer than 1.3.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-13597

Affected Products

微信二维码登陆

References · 3

• 🔥 https://wpscan.com/vulnerability/5e856219-ece5-4d79-8375-fc0cbdc37d6c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-13597 · Security Note
• https://t.me/CVEtracker/61296 · Telegram Post