CVE-2026-77752 in Temporary Login Without Password Plugin
Summary
by MITRE • 09/12/2026
The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole network. The same missing check also allows an existing account, including the attacker's own, to be promoted.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/12/2026
The vulnerability identified in versions of the Temporary Login Without Password plugin prior to 1.9.9 represents a critical privilege escalation flaw within WordPress multisite environments. This security defect stems from a fundamental failure in access control logic, specifically regarding the verification of administrative privileges during the generation and assignment of temporary login credentials. In a standard single-site WordPress installation, this issue may have limited impact; however, in a networked environment where multiple sites share a central database and user base, the consequences are severe. The plugin is designed to allow administrators to generate time-limited access tokens for users without requiring them to create permanent accounts or know passwords. While convenient for granting temporary access to developers or contractors, the implementation fails to validate whether the requesting administrator possesses network-wide super admin rights before elevating a user account to that same elevated status.
From a technical perspective, the core flaw lies in the absence of capability checks when processing requests to promote users. When an administrator initiates the creation of a temporary login for another user and selects options that include granting administrative privileges, the system does not verify if the initiator holds the network_super_admin role or equivalent capabilities defined by WordPress multisite architecture. Consequently, any user with even basic site-level administration rights can exploit this logic gap to promote themselves or other accounts to full network super admin status. This bypasses the intended hierarchical security model of WordPress multisites, where only designated network administrators should have the authority to manage global settings, install plugins across all sites, and control user roles at the network level. The vulnerability effectively allows a local site administrator to gain unrestricted control over the entire WordPress network, including all subsites hosted within it.
The operational impact of this vulnerability is profound, as it leads to complete compromise of the multisite infrastructure. An attacker who gains access to any single site with administrative privileges can leverage this flaw to escalate their permissions globally. Once promoted to a network super admin, the attacker obtains full control over all sites in the network. This includes the ability to install malicious plugins or themes across every subsite, modify core configuration files, export sensitive data from all databases, and create additional backdoor accounts that persist beyond the temporary login window. The lack of verification also means that an existing account, including one already compromised by the attacker, can be permanently promoted without detection through standard audit logs if logging is not rigorously configured for privilege changes. This undermines the principle of least privilege and allows lateral movement within the network with minimal effort or specialized tools.
This vulnerability aligns closely with CWE-269, which describes Improper Privilege Management, specifically in contexts where access control decisions are based on insufficient verification of user roles. Furthermore, it maps to MITRE ATT&CK technique T1078, Valid Accounts, as the attacker utilizes legitimate credentials and administrative functions to escalate privileges within the system. The exploitation path resembles privilege escalation through misconfigured role assignments rather than traditional buffer overflows or injection attacks, highlighting a logical flaw in software design rather than an implementation error in code parsing.
Mitigation strategies must focus on immediate remediation of the vulnerable plugin version and reinforcement of access control policies. Administrators running WordPress multisite networks should upgrade the Temporary Login Without Password plugin to version 1.9.9 or later immediately, as this release addresses the missing permission checks. Until an update is applied, it is advisable to disable the privilege escalation features within the plugin if possible, restricting temporary logins to standard user roles only. Additionally, organizations should enforce strict monitoring of administrative actions and review audit logs for any unauthorized role changes. Implementing multi-factor authentication for all administrator accounts adds a layer of defense against credential theft that could precede such exploitation. Regular security audits focusing on privilege management logic in third-party plugins are essential to prevent similar logical flaws from being introduced or exploited in the future.