CriticalCritical vulnerability

CVE-2026-84734 (CVSS 9.8)

NVD · officialPublished Oct 11, 2026Risk 50/100EPSS 0.1%

The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.

Technical details

CVSS

9.8

AV:NetworkAC:LowPR:NoneUI:NoneC:HighI:HighA:High

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source