Magic Login Mail or QR Code <= 2.05 — Unauthenticated Privilege Escalation via Insecure QR Code File Storage

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Magic Login Mail or QR Code.
• No admin access? Run a passive check of your site. It reads public files only.
• No account is needed to exploit this. Treat any exposed site on an affected version as at risk.

What to do

1. Update to version 2.06, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Magic Login Mail or QR Code to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to ifoundbug.

The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This is due to the plugin storing the magic login QR code image with a predictable, static filename (QR_Code.png) in the publicly accessible WordPress uploads directory during the email sending process. The file is only deleted after wp_mail() completes, creating an exploitable race condition window. This makes it possible for unauthenticated attackers to trigger a login link request for any user, including administrators, and then exploit the race condition between QR code file creation and deletion to obtain the login URL encoded in the QR code, thereby gaining unauthorized access to the targeted user's account.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Feb 13, 2026

   CVE published

   Severity high, CVSS 8.1

2. Nov 13, 2026

   Record last updated