CVE-2026-77752

HighCVSS 7.2

Published: 12/09/2026(UTC)Updated: 14/09/2026(UTC)Translated: 12/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole network. The same missing check also allows an existing account, including the attacker's own, to be promoted.

Risk Assessment

An attacker with administrator rights on one site in a multisite network can gain control over the entire network. This can result in full takeover of all sites in the network.

Recommendation

Update the Temporary Login Without Password plugin to version 1.9.9 or later. Check the multisite network for unauthorized accounts with super admin rights.

Other vulnerabilities in Temporary Login Without Password WordPress plugin

CVE-2026-77753Medium
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site over REST and XML-RPC after the administrator believes it has been withdrawn. The retained access carries whatever role was granted, which for the plugin's main use case is Administrator.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS