Skip to content
Sign in
7.2 High

CVE-2026-77752 The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a…

Description

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole network. The same missing check also allows an existing account, including the attacker's own, to be promoted.

Affected products and versions

Product Affected versions Fixed in
Temporary Login Without Password 1.5 1.5 → < 1.9.9 1.9.9

Other CVEs of Temporary Login Without Password

The 3 CVEs of Temporary Login Without Password →
CVE-2026-77753 The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an… 5.5 Medium CVE-2021-24836 The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when… Not rated
Track this CVE