CVE-2026-2144
Privilege Escalation in Magic Login Mail Plugin via QR Code Race Condition
Publication date: 2026-02-14
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | magic_login_mail | to 2.05 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-2144 is a vulnerability in the Magic Login Mail plugin for WordPress that allows privilege escalation. The issue arises because the plugin stores a magic login QR code image with a predictable and static filename (QR_Code.png) in a publicly accessible uploads directory during the email sending process. This file is only deleted after the email sending function completes, creating a race condition window.'}, {'type': 'paragraph', 'content': "An unauthenticated attacker can exploit this race condition by triggering a login link request for any user, including administrators, and then accessing the QR code image before it is deleted. The QR code contains the login URL, which the attacker can use to gain unauthorized access to the targeted user's account."}, {'type': 'paragraph', 'content': 'The vulnerability was fixed by changing the plugin to generate QR codes in-memory and embed them directly into emails as base64-encoded images, avoiding unsafe file storage and eliminating the race condition.'}] [2]
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows an attacker to escalate privileges without authentication. Specifically, an attacker can gain unauthorized access to any user account, including administrator accounts, by exploiting the predictable QR code file and the race condition.
Such unauthorized access can lead to full compromise of the WordPress site, including the ability to modify content, change settings, install malicious plugins, or steal sensitive information.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves the Magic Login Mail WordPress plugin storing a QR code image with a predictable filename (QR_Code.png) in the publicly accessible uploads directory temporarily during the email sending process. Detection can focus on identifying the presence of this file or monitoring for requests to it.'}, {'type': 'list_item', 'content': 'Check your WordPress uploads directory for the presence of a file named QR_Code.png, especially during or shortly after login link email requests.'}, {'type': 'list_item', 'content': 'Monitor web server access logs for requests to /wp-content/uploads/QR_Code.png or similar paths.'}, {'type': 'list_item', 'content': "Use commands like `grep 'QR_Code.png' /var/log/apache2/access.log` or `grep 'QR_Code.png' /var/log/nginx/access.log` to find access attempts to the QR code file."}, {'type': 'list_item', 'content': 'Scan for the Magic Login Mail plugin version installed on your WordPress site to see if it is version 2.05 or earlier, which is vulnerable.'}] [2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should immediately update the Magic Login Mail plugin to a version later than 2.05 where the vulnerability is fixed.
- Upgrade the Magic Login Mail plugin to the latest version that eliminates unsafe QR code file storage by generating QR codes in-memory and embedding them directly in emails.
- Ensure that your WordPress installation and all plugins are kept up to date to avoid known vulnerabilities.
- If updating immediately is not possible, restrict access to the uploads directory or monitor and block requests to the predictable QR_Code.png file.
- Review and tighten file permissions on the uploads directory to prevent unauthorized file access.