CVE-2026-13597 — CRITICAL (9.1)

Vulnerability Description

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Related Weaknesses (CWE)

CWE-287

References

https://wpscan.com/vulnerability/5e856219-ece5-4d79-8375-fc0cbdc37d6c/

FAQ

What is CVE-2026-13597?

CVE-2026-13597 is a vulnerability with a CVSS score of 9.1 (CRITICAL). The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. Th...

How severe is CVE-2026-13597?

CVE-2026-13597 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-13597?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.