CVE-2026-2144

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2144", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-07T00:47:48.353Z", "datePublished": "2026-02-14T04:35:40.772Z", "dateUpdated": "2026-04-08T16:57:42.720Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:57:42.720Z"}, "affected": [{"vendor": "katsushi-kawamori", "product": "Magic Login Mail or QR Code", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.05", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This is due to the plugin storing the magic login QR code image with a predictable, static filename (QR_Code.png) in the publicly accessible WordPress uploads directory during the email sending process. The file is only deleted after wp_mail() completes, creating an exploitable race condition window. This makes it possible for unauthenticated attackers to trigger a login link request for any user, including administrators, and then exploit the race condition between QR code file creation and deletion to obtain the login URL encoded in the QR code, thereby gaining unauthorized access to the targeted user's account."}], "title": "Magic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/65066a17-653b-4444-9bd0-894ea8c1acb1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/magic-login-mail/trunk/lib/class-magicloginmail.php#L325"}, {"url": "https://plugins.trac.wordpress.org/browser/magic-login-mail/trunk/lib/class-magicloginmail.php#L250"}, {"url": "https://plugins.trac.wordpress.org/changeset/3460417/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-269 Improper Privilege Management", "cweId": "CWE-269", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "ifoundbug"}], "timeline": [{"time": "2026-02-13T16:21:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T20:38:12.495994Z", "id": "CVE-2026-2144", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T20:38:42.732Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2144", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-17T20:38:12.495994Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T20:38:27.572Z"}}], "cna": {"title": "Magic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage", "credits": [{"lang": "en", "type": "finder", "value": "ifoundbug"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "katsushi-kawamori", "product": "Magic Login Mail or QR Code", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.05"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-13T16:21:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/65066a17-653b-4444-9bd0-894ea8c1acb1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/magic-login-mail/trunk/lib/class-magicloginmail.php#L325"}, {"url": "https://plugins.trac.wordpress.org/browser/magic-login-mail/trunk/lib/class-magicloginmail.php#L250"}], "descriptions": [{"lang": "en", "value": "The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This is due to the plugin storing the magic login QR code image with a predictable, static filename (QR_Code.png) in the publicly accessible WordPress uploads directory during the email sending process. The file is only deleted after wp_mail() completes, creating an exploitable race condition window. This makes it possible for unauthenticated attackers to trigger a login link request for any user, including administrators, and then exploit the race condition between QR code file creation and deletion to obtain the login URL encoded in the QR code, thereby gaining unauthorized access to the targeted user's account."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-14T04:35:40.772Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2144", "state": "PUBLISHED", "dateUpdated": "2026-02-17T20:38:42.732Z", "dateReserved": "2026-02-07T00:47:48.353Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-14T04:35:40.772Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Magic Login Mail or QR Code", "vendor": "katsushi-kawamori", "versions": [{"lessThanOrEqual": "2.05", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Magic Login Mail or QR Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.05. This is due to the plugin storing the magic login QR code image with a predictable, static filename (QR_Code.png) in the publicly accessible WordPress uploads directory during the email sending process. The file is only deleted after wp_mail() completes, creating an exploitable race condition window. This makes it possible for unauthenticated attackers to trigger a login link request for any user, including administrators, and then exploit the race condition between QR code file creation and deletion to obtain the login URL encoded in the QR code, thereby gaining unauthorized access to the targeted user's account."}, {"lang": "es", "value": "El plugin Magic Login Mail o QR Code para WordPress es vulnerable a la Escalada de Privilegios en todas las versiones hasta la 2.05, inclusive. Esto se debe a que el plugin almacena la imagen del c\u00f3digo QR de inicio de sesi\u00f3n m\u00e1gico con un nombre de archivo predecible y est\u00e1tico (QR_Code.png) en el directorio de subidas de WordPress de acceso p\u00fablico durante el proceso de env\u00edo de correo electr\u00f3nico. El archivo solo se elimina despu\u00e9s de que wp_mail() se completa, creando una ventana de condici\u00f3n de carrera explotable. Esto hace posible que atacantes no autenticados activen una solicitud de enlace de inicio de sesi\u00f3n para cualquier usuario, incluidos los administradores, y luego exploten la condici\u00f3n de carrera entre la creaci\u00f3n y eliminaci\u00f3n del archivo del c\u00f3digo QR para obtener la URL de inicio de sesi\u00f3n codificada en el c\u00f3digo QR, obteniendo as\u00ed acceso no autorizado a la cuenta del usuario objetivo."}], "id": "CVE-2026-2144", "lastModified": "2026-06-17T10:30:24.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2144", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T20:38:12.495994Z", "version": "2.0.3"}}]}, "published": "2026-02-14T05:16:21.973", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/magic-login-mail/trunk/lib/class-magicloginmail.php#L250"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/magic-login-mail/trunk/lib/class-magicloginmail.php#L325"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3460417/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/65066a17-653b-4444-9bd0-894ea8c1acb1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.05]"}}], "product": "magic_login_mail_or_qr_code", "vendor": "katsushi-kawamori"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T18:32:44.017627+00:00", "value": {"mitigation_remediation": ["Upgrade the Magic Login Mail or QR Code plugin to a version newer than 2.05, where the filename generation and file deletion sequence has been corrected.", "If an upgrade is not immediately possible, block external read access to the WordPress uploads directory (or the subdirectory where the plugin stores QR codes) using web\u2011server rules such as .htaccess directives or iptables, so that only the plugin can delete the file.", "Restrict the magic\u2011login\u2011mail feature to authenticated users or add an additional confirmation step before the email is sent, thereby preventing unauthenticated users from triggering the vulnerable flow."], "summary": {"action": "Patch or Upgrade", "impact": "Privilege Escalation via Unauthenticated QR Code Race Condition"}, "threat_synthesis": {"affected_systems": "Vendors: katsushi\u2011kawamori\u2019s Magic Login Mail or QR Code. Versions up to and including 2.05 are affected. No other version information is provided.", "description_and_impact": "The Magic Login Mail or QR Code WordPress plugin uses a predictable filename for the QR code image (QR_Code.png) that is stored in the publicly accessible uploads directory during the email sending process. Because the file is only removed after wp_mail() finishes, a race condition exists that allows an unauthenticated attacker to capture the file before deletion. By triggering a login link request for any user\u2014including administrators\u2014the attacker can read the temporary QR code file, decode the embedded login URL, and gain unauthorized access to the targeted account. This flaw is a classic example of CWE\u2011269, an authentication weakness that permits privilege escalation.", "risk_and_exploitability": "The CVSS v3 score is 8.1, indicating high severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation at the moment, and the flaw is not yet listed in the CISA KEV catalog. The attack vector is unauthenticated, relying on the plugin\u2019s public QR code storage race condition; an attacker need only send a magic\u2011login\u2011mail request for a target user and cleanse the race window, which can be done remotely without additional credentials."}}}}, "created": "2026-02-16T12:03:18.985155+00:00", "updated": "2026-04-15T18:45:11.411844+00:00", "vendors": ["katsushi-kawamori", "katsushi-kawamori$PRODUCT$magic_login_mail_or_qr_code", "wordpress", "wordpress$PRODUCT$wordpress"]}