The Magic Login Mail or QR Code WordPress plugin uses a predictable filename for the QR code image (QR_Code.png) that is stored in the publicly accessible uploads directory during the email sending process. Because the file is only removed after wp_mail() finishes, a race condition exists that allows an unauthenticated attacker to capture the file before deletion. By triggering a login link request for any user—including administrators—the attacker can read the temporary QR code file, decode the embedded login URL, and gain unauthorized access to the targeted account. This flaw is a classic example of CWE‑269, an authentication weakness that permits privilege escalation.

Vendors: katsushi‑kawamori’s Magic Login Mail or QR Code. Versions up to and including 2.05 are affected. No other version information is provided.

The CVSS v3 score is 8.1, indicating high severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation at the moment, and the flaw is not yet listed in the CISA KEV catalog. The attack vector is unauthenticated, relying on the plugin’s public QR code storage race condition; an attacker need only send a magic‑login‑mail request for a target user and cleanse the race window, which can be done remotely without additional credentials.