Imagine leaving a spare key under your doormat — except the key works for every lock in the building, and anyone who knows the trick can use it.
Who's at Risk and Why It Matters
WordPress powers roughly 43% of every website on the internet. Millions of those sites rely on small, utility-style plugins to handle everyday tasks — including one called Temporary Login Without Password, which lets site owners generate short-lived access links for clients, contractors, or support staff. It's a convenient tool used across business websites, online stores, news portals, and membership platforms worldwide.
A newly disclosed vulnerability rated 9.8 out of 10 (CRITICAL) means that any site running version 1.0.0 or earlier of this plugin is potentially wide open to a complete takeover — no username, no password, no invitation required. An attacker doesn't need to be sophisticated. They don't need to guess anything. They just need to know the trick, and right now that trick is public knowledge.
The blast radius here is significant. E-commerce stores could have customer payment data exposed. Business sites could be silently defaced or turned into malware distributors. Membership platforms could have every user's private data harvested. If your site runs this plugin and you haven't updated it, consider it an unlocked front door on a busy street.
What's Actually Happening Under the Hood
Here's the story of the attack in plain English. When a legitimate user clicks a temporary login link, the website receives a short code — called a token — tucked inside that link. The plugin looks up that token, finds the matching temporary user account, and logs them in. Simple enough.
The problem is that the plugin's developer assumed that token would always arrive as a single piece of text — a word, a string of letters and numbers. They never anticipated that an attacker could send it as a list instead of a word. PHP, the programming language that runs most of WordPress, happily accepts both formats. When the token arrives as a list (even an empty one), a safety check that was supposed to catch blank or missing tokens gets fooled into thinking everything is fine. The plugin then tries to "clean up" that list, which produces a completely empty result. It takes that empty result and asks WordPress: "give me all users who have a temporary login token." WordPress, receiving a blank search term, interprets this as "give me everyone" — and hands back every single temporary user account on the site.
The attacker then quietly slips in as the first account returned — which could be an administrator. No brute force. No stolen credentials. No social engineering. Just a malformed web request that takes a few seconds to craft. Once inside as an admin, the attacker can install malicious plugins, create backdoor accounts, steal data, redirect visitors to scam sites, or hold the entire site hostage.
The Technical Anchor
Security researchers will want to note the specific failure point: the vulnerability lives inside the maybe_login_temporary_user() function, which processes the temp-login-token GET parameter without first verifying it is a scalar type. The missing is_string() or is_scalar() check before the empty() guard creates a classic type confusion / improper input validation condition (CWE-20). When an array is passed, sanitize_key() returns an empty string, which WordPress's get_users() treats as a wildcard match on the _temporary_login_token meta key — returning all matching users and enabling unauthenticated privilege escalation. The issue is tracked as CVE-2026-7567 with a CVSS score of 9.8 (Critical).
What We Know So Far
The vulnerability was disclosed through responsible channels and, as of publication, there is no confirmed active exploitation in the wild. That is genuinely good news — but it's a narrow window. In the security world, the clock starts ticking the moment a CVE goes public. Attackers scan for vulnerable plugin versions automatically, often within hours of disclosure. The gap between "no known exploitation" and "actively exploited" can close over a weekend.
There are no known victim organizations tied to this specific CVE at this time, and no threat actor groups have been publicly linked to campaigns targeting it. However, authentication bypass vulnerabilities in WordPress plugins have historically been picked up fast by opportunistic attackers running automated scanners — not sophisticated nation-state hackers, but the high-volume, low-effort criminal operations that quietly compromise thousands of sites at once, often to build spam networks or distribute malware to innocent visitors.
What You Should Do Right Now
Three steps, in order of priority:
- Update the plugin immediately. Log into your WordPress dashboard, navigate to Plugins → Installed Plugins, and update Temporary Login Without Password to any version released after 1.0.0. If no patched version is yet available in the WordPress plugin repository, deactivate and delete the plugin entirely until a fix is confirmed. A temporarily inconvenient site is infinitely better than a compromised one.
- Audit your temporary user accounts. Go to Users → All Users in your WordPress dashboard and filter or search for any accounts that were created as temporary logins. Delete any that are expired, unnecessary, or unrecognized. Fewer temporary accounts means a smaller pool of accounts an attacker could have landed in — and it's good hygiene regardless of this vulnerability.
- Review your recent login logs for anomalies. If you have a security plugin like Wordfence (free tier available) or WP Activity Log installed, check for any unexpected logins — particularly any administrator-level sessions that don't match your team's known IP addresses or login times. If you don't have an audit log plugin installed, now is the time to add one. Going forward, any production WordPress site handling real users or transactions should treat login monitoring as non-negotiable.
Bottom line: This one is serious enough to warrant treating it as urgent, not a "get to it this week" item. The patch window before active exploitation begins is unpredictable. Spend fifteen minutes on this today.
CVE-2026-7567 | CVSS 9.8 Critical | Affects: Temporary Login Without Password plugin ≤ 1.0.0 | Category: Authentication Bypass, Privilege Escalation