The vulnerability is an Authentication Bypass via Privilege Escalation (CWE‑287). It allows an attacker to bypass the normal authentication flow by supplying a specially crafted request parameter and gain a session token belonging to the administrator account configured in the plugin. This lack of proper session validation permits an outside actor to assume full administrative privileges within the WordPress site. Based on the description, it is inferred that the attacker can trigger the exploit by sending an unauthenticated HTTP request containing the 'mql_pass' parameter to the plugin endpoint, creating a high‑impact threat of full control over content, configuration and potential data exposure.

Any WordPress site running Mindstien Quick Login plugin version 1.0 or earlier. The plugin is published by an unknown vendor and is accessible through the standard WordPress plugin repository. No specific WordPress core version is required for exploitation. The vulnerability applies to all installations where the plugin is active and has an administrator account configured.

Based on the description, it is inferred that the exploit requires only an unauthenticated HTTP request to the plugin’s entry point with the 'mql_pass' parameter. No special privileges or user interaction are needed. An attacker can construct a request and receive an authenticated session cookie if the plugin accepts the injected value. The CVSS score is 9.8, and the EPSS score is < 1%. The vulnerability is not listed in CISA KEV, implying no confirmed public exploitation yet. Nevertheless, the impact of the flaw and the relative simplicity of the attack vector make it a high‑risk issue that should be addressed promptly.