WeChat QR login webhook permits administrator account takeover
微信二维码登陆 through 1.3 performs a signature check that always succeeds in its WeChat webhook. An unauthenticated attacker can forge a login event for any WordPress username, obtain the generated login code from the webhook response and redeem that code through the plugin's unauthenticated AJAX flow, including to sign in as an administrator. The CNA record does not disclose the webhook path, AJAX action, parameter names or validation functions.
- Component
- 微信二维码登陆
- Plugin slug
- Not applicable
- Affected
- <= 1.3
- Safe version
- See mitigation notes
- Published
- Jul 27, 2026
Update, patch or deactivate.
No fixed release is identified in the authoritative record. Disable and remove 微信二维码登陆 until a version newer than 1.3 is available and confirmed to fix CVE-2026-13597. Review administrator sessions and accounts, force password resets and rotate WordPress salts if the plugin was publicly reachable.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N