The WeChat QR code Login WordPress plugin through version 1.3 fails to validate the signature of incoming WeChat webhook requests; the verification step always succeeds and the plugin discloses the generated login code in the webhook response. This flaw, a CWE‑287 authentication bypass, allows an attacker who does not have site credentials to pose as a valid user, retrieve the login code, and then redeem it via an unauthenticated AJAX action to log in as that account. The flaw consequently enables full control over any existing user, including administrators, without requiring a password.

The vulnerability exists in the WeChat QR code Login WordPress plugin up to and including version 1.3. Site administrators should verify whether this specific plugin and version are in use and consider removing or upgrading the component.

The CVSS score of 9.1 reflects the high impact and ease of exploitation: any member of the public can forge the webhook request, because the signature check is bypassed and the login code is exposed. The EPSS score, currently < 1%, indicates a very low yet nonzero probability of exploitation, while the vulnerability remains not listed in the CISA KEV catalog. Attackers would leverage the public webhook endpoint and the exposed AJAX redeem action to perform the takeover.