The Magic Login Mail or QR Code plugin for WordPress suffers from improper privilege management (CWE-269) due to storing the magic login QR code image as a static, predictable filename (QR_Code.png) in the public uploads directory during the email sending process. The file is deleted only after wp_mail() completes, creating a race condition exploitable by unauthenticated attackers. By triggering a login link request for any user and accessing the QR code image during this window, attackers can extract the login URL and escalate privileges to that user's account. This affects all versions up to and including 2.05.

Successful exploitation allows unauthenticated attackers to gain unauthorized access to targeted user accounts, including those with administrative privileges. This compromises confidentiality, integrity, and availability of the affected WordPress site, enabling full control over the user accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Magic Login Mail or QR Code plugin or restricting access to the uploads directory to prevent unauthorized retrieval of the QR code image. Monitoring for suspicious login link requests may also help detect exploitation attempts.