The 微信二维码登陆 (WeChat QR Login) WordPress plugin through version 1.3 contains a critical authentication bypass vulnerability. The plugin fails to properly validate WeChat webhook requests because its signature verification check always returns a passing result. Additionally, the plugin discloses the generated login code in the webhook response. An unauthenticated attacker can exploit this by forging a webhook login event for any existing username, reading the login code from the response, and then redeeming it via an unauthenticated AJAX action. This effectively allows full account takeover of any user, including administrators, without requiring a password. No authentication or special privileges are needed to exploit this flaw.