Authentication Bypass in Temporary Login Plugin for WordPress

CVE-2026-7567

What is CVE-2026-7567?

CVE-2026-7567 is a vulnerability affecting the Temporary Login plugin for WordPress, specifically in versions up to and including 1.0.0. This plugin facilitates the creation of temporary login links for users, allowing easy access for site administrators to provide limited access to users without creating permanent accounts. The vulnerability arises from improper input validation in the maybe_login_temporary_user() function, specifically concerning the 'temp-login-token' GET parameter. When this parameter is incorrectly supplied as an array, existing checks within the code fail, resulting in a situation where unauthorized individuals can authenticate as any active temporary login user. This flaw compromises the integrity of user authentication, enabling attackers to bypass security controls and gain unauthorized access to user accounts.

Potential impact of CVE-2026-7567

1. Unauthorized Access: Attackers can exploit this vulnerability to gain access to user accounts, including those with elevated privileges, without needing valid authentication credentials. This could lead to unauthorized actions within the WordPress site, putting sensitive information at risk.

2. Account Compromise: By allowing authentication without proper verification, attackers may take control of temporary login users' accounts. This can facilitate data breaches, modification of user settings, or even site defacement, severely undermining user trust and site integrity.

3. Increased Attack Surface: The presence of this vulnerability expands the potential attack vector for threat actors, enabling exploitation at scale. As temporary login accounts are often used for collaborative purposes, the risk multiplies as more users may inadvertently become victims of unauthorized access attempts.

References