CVE-2025-10299
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
The WPBifröst - Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctl_create_link AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create new administrative user accounts and subsequently log in as those.
Analysis
WPBifröst WordPress plugin through version 1.0.7 allows low-privileged authenticated users to escalate to full administrative access. Subscribers and higher roles can exploit a missing capability check in the ctl_create_link AJAX handler to create new administrator accounts and immediately log in with full site control. With CVSS 8.8 (High) and EPSS data unavailable, severity is driven by the low privilege requirement (PR:L) and complete system compromise (C:H/I:H/A:H). No public exploit identified at time of analysis, and not listed in CISA KEV, but the attack is trivially automatable once an attacker holds any authenticated role.
Technical Context
This vulnerability stems from CWE-862 (Missing Authorization), a classic privilege escalation pattern in WordPress plugin development. The WPBifröst plugin is designed to generate temporary login links for administrative access, but the ctl_create_link AJAX action fails to verify that the requesting user has sufficient privileges (such as manage_options capability) before creating new user accounts. WordPress AJAX handlers must explicitly check user capabilities using functions like current_user_can() before performing privileged operations. The plugin's intended functionality - creating temporary admin access - becomes a privilege escalation vector when any authenticated user (including the lowest-privilege Subscriber role) can invoke the account creation mechanism without authorization checks. The vulnerability affects the core authentication and access control subsystem of WordPress installations running this plugin.
Affected Products
WPBifröst - Instant Passwordless Temporary Login Links plugin (also known as create-temporary-login) for WordPress, all versions up to and including 1.0.7. The plugin is distributed through the official WordPress plugin repository at wordpress.org/plugins/create-temporary-login. Any WordPress installation running this plugin with at least one non-administrator authenticated user account is vulnerable to privilege escalation attacks. The vulnerability exists in the AJAX handler code responsible for generating temporary login links, affecting the core functionality of the plugin across all documented releases prior to remediation.
Remediation
Immediately update WPBifröst plugin to version 1.0.8 or later, which addresses the missing capability check vulnerability as documented in the WordPress plugin repository changeset 3379010 available at plugins.trac.wordpress.org. Site administrators should review user account creation logs for any suspicious administrative accounts created by lower-privileged users, particularly examining accounts created through the ctl_create_link AJAX action. As a temporary workaround if immediate patching is not possible, disable the plugin entirely and remove it from active WordPress installations until the update can be applied. After patching, conduct a full user account audit to identify and remove any unauthorized administrator accounts that may have been created during the vulnerability window. Consult the official Wordfence threat intelligence advisory at wordfence.com/threat-intel/vulnerabilities/id/50946bc7-8d31-4376-bdcc-de7aad700503 for additional detection and remediation guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today