What the vulnerability does
01Description
The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This is due to the plugin storing the magic login QR code image with a predictable, static filename (QR_Code.png) in the publicly accessible WordPress uploads directory during the email sending process. The file is only deleted after wp_mail() completes, creating an exploitable race condition window. This makes it possible for unauthenticated attackers to trigger a login link request for any user, including administrators, and then exploit the race condition between QR code file creation and deletion to obtain the login URL encoded in the QR code, thereby gaining unauthorized access to the targeted user's account.
Explanation of Vulnerability in Simple Terms
02Summary
Magic Login Mail or QR Code versions 2.05 and earlier contain a privilege management flaw that allows an unauthenticated attacker to read sensitive data, modify site content, or disrupt service. The vulnerability requires specific network conditions to exploit but does not require user interaction. Site administrators should update to a version newer than 2.05 immediately.
What an attacker can do
03Attacker Capabilities
Read sensitive data, modify site content, or disrupt service without authentication.
Potential impact on your site
04Site Impact
Attackers can access private information, alter pages, or take the site offline without logging in.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
February 14, 2026
CVE published
April 8, 2026
Record updated
