WordPress Plugin Vulnerabilities

QR Redirector < 2.0.4 - Missing Authorization

Description

The QR Redirector plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.0.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
qr-redirector
Fixed in 2.0.4

References

CVE
CVE-2026-24545
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/fafcea5a-1f84-4342-8959-312e3938e4d3

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Legion Hunter
Verified
No
WPVDB ID
6faf459e-c839-46e1-b43e-7137f4a4c1a0

Timeline

Publicly Published
2026-05-25 (about 2 months ago)
Added
2026-05-26 (about 1 month ago)
Last Updated
2026-05-26 (about 1 month ago)

Other

Published
Title
Published
2026-01-19
Title
Custom Fonts – Host Your Fonts Locally < 2.1.17 - Missing Authorization to Unauthenticated Font Deletion
Published
2024-01-30
Title
WordPress Review & Structure Data Schema Plugin – Review Schema < 2.2.0 - Missing Authorization to Arbitrary Review Update
Published
2025-10-15
Title
Felan Framework < 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation/Deactivation via process_plugin_actions
Published
2025-06-27
Title
Constructor <= 1.6.5 - Missing Authorization
Published
2026-05-20
Title
PDF for Elementor Forms + Drag And Drop Template Builder < 5.6.1 - Missing Authorization