Temporary Login Plugin EUVD-2026-76811

Exploitation requires three specific conditions: (1) the target WordPress installation must be configured as a multisite network - single-site installations are entirely unaffected; (2) the Temporary Login Without Password plugin must be installed and active in a way that grants the attacker access to its management interface; (3) the attacker must hold existing site-administrator credentials on at least one subsite within the network (PR:H per CVSS vector). Exploitation does not require the network super admin to be logged in, to click anything, or to interact with the attacker's request. Key limiting factors include the requirement for authenticated site-admin access (unauthenticated users, subscribers, and editors cannot exploit this), and the dependency on WordPress multisite configuration, which is less common than standard single-site deployments.

The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects the core tension: while the downstream impact is full CIA compromise of the entire multisite network, exploitation is gated behind existing site-administrator credentials (PR:H), which meaningfully constrains the exploitable population. EPSS at 0.14% (4th percentile) is consistent with that gated attack surface, and the vulnerability is absent from CISA KEV. No public exploit code has been identified, further reducing immediate automated risk. In practice, even a mid-sized municipal IT team in leszno running a WordPress multisite for multiple departmental subsites should treat this as urgent if they host external site admins - contractors, agencies, or third-party developers with delegated subsite access represent credible insider-pivot threats. The realistic adversarial scenario is an authenticated-but-restricted party escalating to full network control, not an unauthenticated internet attacker. The scope=unchanged CVSS metric marginally understates network-level blast radius, which functions more like a scope change in multisite deployments.

A third-party web development contractor who has been granted site-administrator access to one department subsite accesses the Temporary Login Without Password plugin interface and creates a new temporary login, designating it the Super Admin network role. Because the plugin does not verify the contractor holds network super admin rights before assigning them, the temporary login is created with full network privileges, giving the contractor - or any recipient of the link - unrestricted control over all subsites, plugins, themes, and user accounts across the entire WordPress multisite installation.