CVE-2026-13597
Last modified
CVE-2026-13597 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password..
Description
The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | 微信二维码登陆 | <= 1.3 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-13597?
How severe is CVE-2026-13597?
How do I fix CVE-2026-13597?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-13590A security flaw has been discovered in seladb PcapPlusPlus 2…5.6
- CVE-2026-13591A weakness has been identified in DeepMyst Mysti 0.4.0. Affe…5
- CVE-2026-13592A vulnerability was detected in liftoff-sr CIPster up to e8e…7.3
- CVE-2026-13593CSS::Minifier::XS versions before 0.14 for Perl have a memor…6.5
- CVE-2026-13595A flaw was found in the libblkid library of util-linux. Duri…5.3
- CVE-2026-13596The Participants Database WordPress plugin before 2.7.8.4 do…9.1
- CVE-2026-1360The BuddyPress plugin for WordPress is vulnerable to Deseria…7.5
- CVE-2026-13600The AutoNetTV Relay WordPress plugin before 3.0.14 does not …8.1
- CVE-2026-13601A flaw was found in Yelp due to an overly permissive Content…6.5
- CVE-2026-13602We found a chain of combining multiple weaknesses in the pro…7.7
- CVE-2026-13603The payment integration pretix-oppwa provides support for t…9
- CVE-2026-13604The Pixelavo WordPress plugin before 1.5.4 registers an una…5.3
Are you affected by CVE-2026-13597?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST