Executive brief
The Temporary Login Without Password WordPress plugin allows administrators to grant time-limited access to their sites. A flaw in the plugin allows a recipient of temporary access to create an Application Password, which remains valid even after the temporary login has expired or been revoked by the administrator. An attacker can use this persistent credential to maintain unauthorized administrator access to the site via REST API and XML-RPC long after the temporary access should have ended.
Technical details
The vulnerability is an access control bypass (CWE-284) in the Temporary Login Without Password WordPress plugin versions before 1.9.9. The plugin does not prevent temporary users from creating Application Passwords through the REST API endpoint `/wp/v2/users/me/application-passwords`, and fails to revoke these credentials when temporary access expires or is disabled. An authenticated user with temporary access (even with low privileges like Subscriber) can create a REST/XML-RPC credential that persists indefinitely. If the temporary role is Administrator, this allows post-revocation unauthorized administrative actions. The attack requires HTTPS (for Application Password support), active plugin, WordPress 5.6+, and the attacker must receive a temporary login link. The vulnerability was fixed in version 1.9.9.
Affected products
- WP Temporary Login Without Password Temporary Login Without Password before 1.9.9
Timeline
- 2026-09-10: disclosed
- 2026-09-12: patched: Fixed in version 1.9.9