EUVD-2026-26490Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
The Temporary Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.0.0. This is due to improper input validation in the maybe_login_temporary_user() function, which fails to verify that the 'temp-login-token' GET parameter is a scalar string before processing it. When the parameter is supplied as an array, PHP's empty() check is bypassed and sanitize_key() returns an empty string, which is then passed as the meta_value to get_users(). WordPress ignores an empty meta_value and returns all users matching the meta_key '_temporary_login_token', allowing authentication without a valid token. This makes it possible for unauthenticated attackers to authenticate as any active temporary login user by sending a single crafted GET request.
AnalysisAI
Authentication bypass in the Temporary Login WordPress plugin (versions ≤1.0.0) allows remote unauthenticated attackers to authenticate as any temporary login user via a single crafted GET request. The vulnerability exploits a type juggling flaw where passing 'temp-login-token' as an array bypasses validation checks and causes WordPress to return all users with temporary login tokens, enabling complete account takeover without knowledge of valid credentials. CVSS 9.8 (Critical) with network attack vector and no prerequisites. EPSS data not available; exploitation requires the presence of active temporary login accounts created by site administrators.
Technical ContextAI
This vulnerability stems from PHP type juggling combined with improper input validation (CWE-288: Authentication Bypass Using an Alternate Path or Channel). The maybe_login_temporary_user() function in core/options.php processes the 'temp-login-token' GET parameter without verifying it is a scalar string. When an attacker supplies the parameter as an array (e.g., temp-login-token[]=exploit), PHP's empty() function returns false for non-empty arrays, bypassing the intended validation gate. The sanitize_key() function, when passed an array, returns an empty string. This empty string is then used as the meta_value argument in a get_users() query filtering for meta_key '_temporary_login_token'. WordPress's WP_User_Query class interprets an empty meta_value as 'ignore this filter criterion' and returns all users possessing the meta_key, regardless of the actual token value. This design flaw transforms what should be a highly-specific credential check into a complete authentication bypass, exploitable through standard HTTP parameter manipulation techniques common in PHP applications.
RemediationAI
Immediately disable and remove the Temporary Login plugin from all WordPress installations until a patched version is released. No vendor-released patch version is identified in available data at time of analysis; monitor the WordPress plugin repository and Wordfence advisory for update announcements. For organizations with critical dependency on temporary login functionality, implement compensating controls: (1) Delete all existing temporary login accounts via WordPress user management to eliminate exploitable targets, noting this breaks legitimate temporary access workflows. (2) Deploy web application firewall rules to block HTTP requests containing array-style GET parameters matching 'temp-login-token' pattern (e.g., temp-login-token[]), though sophisticated attackers may bypass via encoding or alternate array syntax - test thoroughly before production deployment. (3) Monitor authentication logs for unexpected logins from temporary user accounts, particularly multiple rapid authentication attempts or geographic/IP anomalies. (4) Consider alternative temporary access solutions such as time-limited standard user accounts with role restrictions, Temporary Admin User plugins with verified input validation, or enterprise SSO with conditional access policies. All compensating controls introduce operational friction or gaps; permanent fix requires vendor-patched code with scalar type enforcement on token parameters.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today