{"id":"CVE-2026-84734","published":"2026-10-11T07:17:25.687","lastModified":"2026-10-13T20:36:00.850","description":"The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/648d461c-6610-4566-a310-b02187d68cc9/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Mindstien Quick Login plugin fails to validate session tokens properly, allowing attackers to hijack administrator sessions without authentication. This creates a critical authentication bypass vulnerability that can lead to full administrative control of affected WordPress sites.","exploitability":"Highly exploitable with no prerequisites - attackers only need to know the plugin's configuration to craft a request that impersonates an admin session.","blast_radius":"Affects all WordPress sites using the Mindstien Quick Login plugin version 1.0, potentially compromising entire administrative accounts and allowing full site takeover.","remediation":"Upgrade to version 1.1 or later to fix the session validation flaw in the Mindstien Quick Login plugin.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","wordpress","session-hijack"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:50:50.759Z"}}