Description

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site over REST and XML-RPC after the administrator believes it has been withdrawn. The retained access carries whatever role was granted, which for the Temporary Login Without Password WordPress plugin before 1.9.9's main use case is Administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-12T06:16:25.183Z",
  "pubdate": "2026-09-12T06:16:25.183Z",
  "executiveSummary": "The Temporary Login Without Password WordPress plugin, in versions prior to 1.9.9, contains a critical authentication bypass vulnerability related to session management. The flaw stems from the plugin's failure to restrict the creation of WordPress Application Passwords by temporary users and a subsequent failure to invalidate these credentials upon the expiration or manual revocation of the temporary login access.\nThis vulnerability allows an attacker who has been granted temporary access—typically with administrative privileges—to generate persistent secondary credentials. Once the temporary access token expires or is deleted by the site administrator, the attacker retains unrestricted access to the WordPress environment via REST API and XML-RPC interfaces. This effectively circumvents the intended temporary nature of the account, granting the attacker long-term persistence with the privileges originally assigned, including the ability to perform full administrative actions. The risk is high, as the persistence mechanism is non-obvious to administrators, facilitating unauthorized remote code execution or data exfiltration long after the initial access window has closed.",
  "technicalDetails": "The vulnerability is rooted in the decoupling of session-based temporary access and the WordPress core user account system. When the Temporary Login Without Password plugin initializes a temporary login, it creates a standard WordPress user account. While the plugin provides a hook to disable or delete this account upon expiration, it does not explicitly manage or prune WordPress Application Passwords (introduced in WordPress 5.6).\nApplication Passwords are designed for authentication against REST and XML-RPC APIs without requiring the session cookies associated with a web browser. Because the plugin does not enforce restrictions on the 'application_passwords' capability for temporary accounts, a user provided with temporary access can navigate to their user profile and generate an Application Password.\nThe attack flow follows a sequential pattern: 1) The attacker is granted temporary access (e.g., Administrator role) by an administrator. 2) The attacker logs into the WordPress dashboard and accesses their user profile settings. 3) The attacker creates an Application Password for use with the REST API. 4) The administrator eventually revokes or expires the temporary login via the plugin's interface, which deletes the temporary user account or disables the session. 5) Because Application Passwords are stored in the user_meta table and are not strictly tied to the plugin's lifecycle management, the attacker retains the ability to authenticate via the WordPress REST API using the generated credentials.\nThe impact is significant, as the REST API provides the same capabilities as the web interface for an administrative account. An attacker can leverage these retained credentials to create new administrative users, install malicious plugins, modify site configuration, or inject arbitrary content into the database. The exploitation requires no further interaction after the initial password generation, and the persistent access is not automatically revoked when the plugin's cleanup routines trigger. This effectively results in a permanent backdoor that bypasses the core security controls of the plugin, leaving the application vulnerable to unauthorized remote administration indefinitely."
}