CVE-2026-13597 in 微信二维码登陆 Plugin
Summary
by MITRE • 07/27/2026
The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability in the 微信二维码登陆 WordPress plugin version 1.3 represents a critical authentication bypass flaw that undermines the security of WordPress installations relying on WeChat login functionality. This issue stems from inadequate validation mechanisms within the plugin's webhook processing logic, creating a pathway for unauthorized access to administrative accounts and user sessions. The flaw specifically manifests in two interconnected weaknesses that compound the severity of the vulnerability.
The core technical flaw involves the plugin's signature verification mechanism which consistently returns a positive authentication result regardless of the actual request integrity. This occurs due to improper implementation of cryptographic signature validation where the plugin fails to properly verify the authenticity of incoming WeChat webhook requests through the signature parameter. Additionally, the plugin exposes generated login codes directly within webhook responses, creating an information disclosure vulnerability that provides attackers with the necessary credentials to execute successful login operations.
The operational impact of this vulnerability extends far beyond simple unauthorized access, as it enables attackers to impersonate any existing user account within the WordPress system including high-privilege administrator roles. The lack of proper authentication checks combined with the exposure of login codes in webhook responses creates a complete attack vector where an unauthenticated attacker can construct forged login events and redeem them through unauthenticated AJAX endpoints. This allows for privilege escalation without requiring knowledge of user passwords, making it particularly dangerous in environments where administrative access is critical.
Security professionals should recognize this vulnerability as aligning with CWE-347 weakness category related to improper verification of cryptographic signatures and CWE-200 information exposure issues. The attack pattern demonstrates characteristics consistent with ATT&CK technique T1566.001 for credential access through social engineering, though in this case the social engineering aspect is replaced by a technical flaw that bypasses authentication entirely. Organizations using this plugin should immediately implement mitigation strategies including disabling the affected plugin functionality, implementing additional webhook request validation mechanisms, and monitoring for unauthorized login attempts.
The vulnerability highlights the critical importance of proper input validation and authentication mechanisms in WordPress plugins, particularly those handling third-party authentication flows. Security measures should include implementing robust signature verification using appropriate cryptographic algorithms, removing sensitive information from response payloads, and ensuring that all authentication endpoints require proper authorization checks. Additionally, regular security audits of plugin code should be conducted to identify similar vulnerabilities that could compromise user accounts and system integrity through improper validation of external requests.