Mindstien Quick Login: Authentication bypass leading to administrator takeover
Summary
The Mindstien Quick Login WordPress plugin up to and including version 1.0 does not properly validate a request value against the visitor's own session before authenticating them. An unauthenticated attacker can obtain a session as the administrator account configured in the plugin, which allows full control over the WordPress site. No user interaction or credentials are required, and the flaw is reachable over the internet on any site where the plugin is active.
Affected
- Mindstien Quick Login WordPress plugin (slug mindstien-quick-login), versions 0 to 1.0
- Vendor is unknown; no official vendor advisory was found
Fixed in
Unknown. No fixed version is confirmed by the vendor or WPScan. A Positive Technologies source mentions version 1.1 as a fix, but this is unverified.
Workaround
- No vendor mitigation found
- Deactivate and delete the plugin until a verified fixed version is available
Exploitation
- No known exploitation in the wild reported
- Not listed in CISA KEV
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total
- Public proof of concept: unconfirmed
Our recommendation
- Check all WordPress sites for the plugin mindstien-quick-login and remove it if present
- Review the administrator user list for unexpected accounts or role changes
- Review login and admin activity logs for unexpected administrator logins
- Reset administrator passwords and invalidate active sessions if compromise is suspected
- Restrict access to wp-admin and the login page by IP, VPN or firewall where feasible
- Monitor for new plugin updates and re-evaluate only after a verified fix is published
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- OpenCVE CVE-2026-84734 app.opencve.io
- VulDB CVE-2026-84734 vuldb.com
- Vulners NVD record CVE-2026-84734 vulners.com
- Offseq threat radar entry radar.offseq.com
- Positive Technologies PT-2026-110035 vulners.com
- GitHub issue astruzocyber CVE 1697 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:15.
Original description (NVD)
The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own session before authenticating them, allowing unauthenticated attackers to obtain a session as the administrator account the Mindstien Quick Login WordPress plugin through 1.0 is configured with.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.