CVE-2026-13597 is an improper authentication vulnerability (CWE-287) in the 微信二维码登陆 WordPress plugin through version 1.3. The plugin does not correctly validate WeChat webhook requests because its signature verification always succeeds regardless of the actual request authenticity. Additionally, it leaks the generated login code in the webhook response. An attacker can exploit this by forging a login event for any existing username, reading the login code from the response, and redeeming it via an unauthenticated AJAX action to gain access as that user without needing a password. This results in a critical authentication bypass allowing full account takeover, including administrator accounts.

An unauthenticated attacker can bypass authentication controls to log in as any user, including administrators, without credentials. This compromises confidentiality and integrity by granting unauthorized access to user accounts and potentially administrative control over the WordPress site. There is no impact on availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's webhook endpoints if possible and monitor for suspicious login activity. Avoid using the affected plugin version in production environments.