CVE-2026-7567: Temporary Login for WordPress up to 1.0.0 - Authentication Bypass

Overview

The Temporary Login plugin for WordPress contains an authentication bypass in versions up to and including 1.0.0. The record attributes the flaw to weak input validation in how a temporary login token parameter is handled, which can allow an unauthenticated visitor to be signed in as a user who holds an active temporary login. The vendor-neutral details are published by Wordfence and listed in the NVD entry.

Impact

• Unauthenticated remote access to accounts that have active temporary logins, which can lead to account takeover.
• The record lists a CVSS 3.1 base score of 9.8 (Critical) with high confidentiality, integrity and availability impact.
• The weakness is classified as CWE-288, authentication bypass using an alternate path or channel.

Affected products and versions

• The record lists the product as 'Elemntor Temporary Login' with versions 1.0.0 and earlier. The product name appears to differ from the plugin name and should be reconciled before relying on it.
• No fixed version is listed in the record.

Exploitation status

• The vulnerability is not listed in the CISA KEV catalog in the data consulted.
• No confirmed exploitation in the wild appears in the sources consulted.
• The SSVC record shows exploitation as none and automatable as yes. The EPSS probability is 0.02931 with a percentile of 0.8675.

Remediation and mitigation

• Confirm whether the Temporary Login plugin is installed and which version is active on each WordPress site.
• Check the plugin repository and the Wordfence advisory for an updated release, since the record does not provide a fixed version.
• Until a fixed release is verified, consider deactivating and removing the plugin if temporary login functionality is not essential.
• Review the list of active temporary logins and revoke any that are not needed.
• Review recent account activity and rotate credentials for users whose sessions appear unexpected.

Detection guidance

• Review web server and access logs for requests to login-related paths that include the temp-login-token parameter, especially requests with unusual parameter formats.
• Monitor for successful sign-ins to accounts that were not expected to authenticate, particularly accounts that had temporary access.
• Correlate authentication events with requests from unfamiliar IP addresses or unexpected user agents.

Limitations of the available information

• The record does not list a fixed version, a patch, or a vendor statement beyond the referenced sources.
• The source status is recorded as Deferred, so the information may change.
• The product name in the record differs from the plugin name, so the affected-product entry should be verified independently.
• Exploitation indicators rely on the KEV, EPSS and SSVC values in the record and may change over time.

Frequently asked questions

Which versions of Temporary Login are affected by CVE-2026-7567?

The record lists versions 1.0.0 and earlier as affected. The product name in the record differs from the plugin name, so verify the installed version directly.

Is there a fixed version available?

The record does not list a fixed version. This means the fix status is unknown, not that no fix exists. Check the plugin repository and the Wordfence advisory.

Is this vulnerability known to be exploited in the wild?

It is not listed in CISA KEV in the data consulted, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.