Temporary Login EUVD-2026-26490

Exploitation requires the target WordPress installation to have the Temporary Login plugin installed (any version up to 1.0.0) AND one or more active temporary login user accounts created by site administrators. The vulnerability is exploitable against default plugin configurations with no additional feature enablement or non-standard settings required. Attack vector is network-based (AV:N) with no authentication prerequisites (PR:N), no required user interaction (UI:N), and low attack complexity (AC:L). Exploitation is limited to environments where administrators have actively used the plugin's temporary account creation functionality; WordPress sites with the plugin installed but zero active temporary users are not vulnerable to account takeover (though the code flaw persists). The attack succeeds regardless of WordPress version, hosting environment, or security hardening measures, as it exploits application-layer logic rather than infrastructure weaknesses. No specific PHP version, web server configuration, or WordPress multisite/single-site distinction affects exploitability.

Critical real-world risk confirmed by multiple signals. CVSS 9.8 reflects maximal severity (AV:N/AC:L/PR:N/UI:N) - remote unauthenticated exploitation with low complexity against default configurations. The vulnerability requires zero authentication, zero user interaction, and no special network positioning, making it trivially exploitable. However, realistic risk depends heavily on deployment context: exploitation requires that site administrators have created active temporary login accounts using this plugin, which limits the attack surface compared to universally exploitable flaws. The type juggling attack pattern is well-understood and easily automated. While no CISA KEV listing or public exploit code is confirmed at time of analysis, the technical barrier is extremely low - any attacker familiar with PHP parameter manipulation can weaponize this within minutes of disclosure. Organizations using Temporary Login plugin for legitimate access delegation (contractor access, support sessions, client demonstrations) face immediate account takeover risk. The lack of EPSS data prevents probabilistic exploitation forecasting, but the combination of critical CVSS, trivial exploitation technique, and WordPress's massive install base suggests high likelihood of rapid weaponization post-disclosure. Priority should be maximum for any WordPress installation with this plugin active and temporary login accounts present.

An unauthenticated attacker identifies a WordPress site using the Temporary Login plugin through passive reconnaissance (plugin enumeration via wp-content/plugins directory listing or HTML source analysis). The attacker crafts a GET request to the WordPress login endpoint with the temp-login-token parameter supplied as an empty array: https://target-site.com/wp-login.php?temp-login-token[]=. The malformed parameter bypasses input validation, causing WordPress to return all users with temporary login tokens. The attacker is automatically authenticated as the first matching temporary user (typically the most recently created), gaining full access to that user's capabilities within WordPress. If the temporary account has administrative privileges (common in contractor or support scenarios), the attacker achieves complete site compromise and can install backdoors, exfiltrate data, or deploy malware.