CVE-2026-2144: 
WordPress vulnerability analysis and mitigation

CVE-2026-2144 is a privilege escalation vulnerability in the Magic Login Mail or QR Code plugin for WordPress, affecting all versions up to and including 2.05. The flaw arises from a race condition in how the plugin handles QR code image files during the magic login email process, allowing unauthenticated attackers to gain unauthorized access to any user account, including administrators. It was published on February 14, 2026, with a CVSS v3.1 base score of 8.1 (High) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-269 (Improper Privilege Management). During the magic login email sending process, the plugin temporarily stores the QR code image with a predictable, static filename (QR_Code.png) in the publicly accessible WordPress uploads directory. The file is only deleted after wp_mail() completes, creating a race condition window during which an unauthenticated attacker can retrieve the file and decode the login URL embedded in the QR code. An attacker first triggers a login link request for a target user (including administrators), then races to fetch the publicly accessible QR_Code.png before it is deleted, extracting the one-time login URL. A proof-of-concept exploit is publicly available on GitHub (Red Hat CVE, PoC GitHub).

Successful exploitation allows an unauthenticated remote attacker to obtain a valid magic login URL for any WordPress user, including site administrators, and authenticate as that user without credentials. This results in complete compromise of confidentiality, integrity, and availability of the affected WordPress installation — an attacker with administrator access can install malicious plugins, exfiltrate data, deface the site, or pivot to the underlying server. All WordPress sites running the Magic Login Mail or QR Code plugin version 2.05 or earlier are at risk (Red Hat CVE, Wordfence).

A proof-of-concept exploit was published on GitHub on February 15, 2026, shortly after the CVE was disclosed (PoC GitHub). As of the latest available data, there is no confirmed evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.052% (0.000520), indicating a currently low probability of exploitation in the near term. No patch has been released as of the time of reporting, and no specific threat actor attribution has been identified (Red Hat CVE).

1. Reconnaissance: Identify WordPress sites using the Magic Login Mail or QR Code plugin (version ≤ 2.05) via passive scanning tools (e.g., WPScan, Shodan) or by checking plugin metadata at https://target.com/wp-content/plugins/magic-login-mail-or-qr-code/.
2. Trigger login request: Send an unauthenticated HTTP request to the WordPress site to initiate a magic login email for a target user (e.g., an administrator), using the plugin's login request endpoint or form.
3. Race the file creation: Immediately and repeatedly poll the publicly accessible URL https://target.com/wp-content/uploads/QR_Code.png in a tight loop, attempting to download the QR code image before wp_mail() completes and the file is deleted.
4. Decode the QR code: Once the QR_Code.png file is successfully retrieved, use a QR code decoder (e.g., zbarimg, online tools, or Python's pyzbar library) to extract the magic login URL embedded in the image.
5. Authenticate as target user: Navigate to the extracted magic login URL in a browser or via an HTTP request to authenticate as the targeted user (including administrators) without any credentials (PoC GitHub, Red Hat CVE).

• Network: Repeated rapid HTTP GET requests to https://[site]/wp-content/uploads/QR_Code.png from a single IP or user agent in a short time window; unusual login activity from unexpected IP addresses immediately following magic login email requests.
• Logs: WordPress access logs showing high-frequency polling of /wp-content/uploads/QR_Code.png; authentication events (successful logins) for administrator accounts from IPs that did not initiate the original login request; magic login email trigger events for administrator accounts not initiated by the account owner.
• File System: Presence of QR_Code.png in the WordPress uploads directory outside of expected email-sending windows (may indicate timing anomalies); unexpected session creation for privileged accounts in WordPress session logs.
• Process/Application: Unexpected administrator-level actions (plugin installation, user creation, settings changes) in WordPress audit logs shortly after a magic login email was triggered (Red Hat CVE, Wordfence).

As of the time of reporting, no patched version of the Magic Login Mail or QR Code plugin has been released; the recommended action is to immediately disable or remove the plugin from all WordPress installations. As a temporary workaround, implement Web Application Firewall (WAF) rules to block public access to QR_Code.png in the WordPress uploads directory (e.g., deny access to /wp-content/uploads/QR_Code.png). Additionally, monitor access logs for suspicious polling of the QR code file and implement rate limiting on magic login email requests. Qualys has published a detection for this vulnerability (Detection ID: 530999) to assist in identifying affected systems (Red Hat CVE, Qualys, Wordfence).

Wordfence included CVE-2026-2144 in their weekly WordPress vulnerability report for February 9–15, 2026, highlighting it as a notable privilege escalation risk for WordPress site administrators (Wordfence). Red Hat tracked the CVE in their security advisory database, and multiple vulnerability aggregators (Vulners, CIRCL, INCIBE) rapidly indexed the disclosure. Community reaction has focused on the absence of a vendor patch and the availability of a public PoC, with security practitioners advising immediate plugin removal as the only reliable mitigation.