Authentication Bypass in Temporary Login Plugin for WordPress

CVE-2026-7567

What is CVE-2026-7567?

The Temporary Login plugin for WordPress is susceptible to an authentication bypass due to improper input validation in its maybe_login_temporary_user() function. This vulnerability occurs when the 'temp-login-token' GET parameter is improperly processed as an array, causing PHP's empty() check to be circumvented. Consequently, an unvalidated value is passed to get_users(), enabling unauthenticated attackers to authenticate as any active temporary login user by simply sending a crafted GET request with null or misleading parameters, thereby granting unauthorized access.

References