WordPress Temporary Login Without Password plugin < 1.9.9 - Authenticated Temporary Access Revocation Bypass vulnerability

Authenticated Temporary Access Revocation Bypass vulnerability discovered by BaptouTatis in WordPress Plugin Temporary Login Without Password versions 1.9.9...

CVE-2026-77753: Improper Access Control

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site ov...

CVE-2026-77752: Improper Privilege Management

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole...

CVE-2021-24836: Missing Authorization

The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them...