CVE-2026-2144
Published: 14 February 2026
Description
The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This is due to the plugin storing the magic login QR code image with a predictable, static…
more
filename (QR_Code.png) in the publicly accessible WordPress uploads directory during the email sending process. The file is only deleted after wp_mail() completes, creating an exploitable race condition window. This makes it possible for unauthenticated attackers to trigger a login link request for any user, including administrators, and then exploit the race condition between QR code file creation and deletion to obtain the login URL encoded in the QR code, thereby gaining unauthorized access to the targeted user's account.
Mitigating Controls (NIST 800-53 r5)AI
Directly restricts unauthorized access to sensitive publicly accessible content, such as the predictable QR_Code.png file in the WordPress uploads directory, preventing exploitation of the race condition.
Enforces protections on public interfaces like the web server exposing the uploads directory, blocking unauthorized retrieval of the QR code containing the login URL.
Enforces approved access authorizations to system resources, preventing unauthenticated attackers from accessing the temporarily stored QR code file during the race window.
Security SummaryAI
CVE-2026-2144 is a privilege escalation vulnerability affecting the Magic Login Mail or QR Code plugin for WordPress in all versions up to and including 2.05. The issue stems from the plugin storing a magic login QR code image with a predictable, static filename (QR_Code.png) in the publicly accessible WordPress uploads directory during the email sending process. This file is only deleted after the wp_mail() function completes, creating a race condition window that exposes the QR code containing the login URL.
Unauthenticated attackers can exploit this vulnerability by triggering a login link request for any targeted user, including administrators. During the brief window between file creation and deletion, the attacker races to access and download the QR_Code.png file from the uploads directory, decode the QR code to obtain the login URL, and gain unauthorized access to the targeted user's account. The CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network accessibility without privileges but high attack complexity due to the race condition, with high impacts on confidentiality, integrity, and availability. It is associated with CWE-269 (Improper Privilege Management).
Mitigation details are outlined in advisories such as Wordfence threat intelligence and WordPress plugin trac references, including source code locations in class-magicloginmail.php (lines 250 and 325) and changeset 3460417, which likely addresses the issue through patching. Security practitioners should update the plugin beyond version 2.05 and review upload directory permissions to prevent exploitation.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated attackers to exploit a public-facing WordPress plugin via a race condition to obtain magic login URLs, directly mapping to exploitation of public-facing applications.