Description

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole network. The same missing check also allows an existing account, including the attacker's own, to be promoted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-12T06:16:25.070Z",
  "pubdate": "2026-09-12T06:16:25.070Z",
  "executiveSummary": "The Temporary Login Without Password WordPress plugin before version 1.9.9 contains a critical privilege escalation vulnerability.\nThe flaw stems from an improper authorization check during the temporary login generation and account promotion process.\nAn authenticated attacker with administrator privileges on a single site within a WordPress multisite network can exploit this flaw to elevate their privileges to network-level super admin.\nThis vulnerability allows an attacker to achieve full control over the entire multisite installation, compromising every site and sub-site within the network.\nThe vulnerability requires existing administrative access to a sub-site but does not require super admin rights to initiate.\nThe impact is total system compromise, potentially leading to unauthorized data access, code execution, and network-wide administrative control.",
  "technicalDetails": "The vulnerability is rooted in an insufficient capability check within the Temporary Login Without Password plugin. When the plugin processes requests to create temporary login links or manage account roles, it fails to verify whether the requesting user possesses 'manage_network' or equivalent super admin privileges before applying high-privileged roles.\nIn a WordPress multisite environment, administrative roles are segregated; a site administrator typically only has authority over their specific sub-site. However, the plugin performs an inadequate verification of user context, effectively trusting the requester's input or failing to restrict the role assignment scope.\nExploitation involves an attacker, who holds standard site administrator access, interacting with the plugin's functionality to generate a temporary link or modify an account. By submitting a crafted request, the attacker can force the application to assign 'super admin' capabilities to either a new temporary account or an existing account they control. Because the plugin does not gatekeep these operations against the network-wide 'super admin' requirement, the application logic proceeds to update the user capabilities in the database.\nThe attack flow follows these steps: 1) The attacker authenticates to a sub-site where they hold administrative privileges. 2) The attacker triggers the plugin's account creation or role modification feature. 3) The malicious request bypasses missing authorization checks, instructing the plugin to promote the user or the newly created account to the network-wide super administrator role. 4) The plugin executes the privilege change with the backend WordPress API without verifying the context. 5) The attacker gains elevated credentials that bypass sub-site restrictions, granting them full administrative authority over the entire network infrastructure.\nThis represents a failure in 'Authorization Bypass' (CWE-862). The lack of input validation regarding the scope of the assigned privileges allows for horizontal and vertical privilege escalation. Post-exploitation, the attacker gains the ability to manage all sites, install/activate arbitrary plugins/themes network-wide, and access sensitive data across the entire multisite instance, resulting in a complete security boundary collapse."
}