CVE-2025-10299 Overview
CVE-2025-10299 is a privilege escalation vulnerability in the WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress. The flaw affects all versions up to and including 1.0.7. The plugin fails to perform a capability check on the ctl_create_link AJAX action, allowing authenticated users with Subscriber-level access or higher to create new administrative accounts. Attackers can then authenticate as the newly created administrator and take full control of the WordPress site. The vulnerability is classified under CWE-862: Missing Authorization.
Critical Impact
Any authenticated user, including low-privileged Subscribers, can escalate to full administrator access and compromise the entire WordPress installation.
Affected Products
- WPBifröst – Instant Passwordless Temporary Login Links WordPress plugin
- All versions from initial release through 1.0.7
- WordPress sites with the plugin installed and active
Discovery Timeline
- 2025-10-15 - CVE-2025-10299 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-10299
Vulnerability Analysis
The WPBifröst plugin exposes the ctl_create_link AJAX endpoint to generate temporary passwordless login links. The handler registers the action through WordPress's wp_ajax_ hook, which authenticates the request but does not enforce role-based authorization. Because the handler omits a current_user_can() capability check, any logged-in user can invoke it.
When invoked, the endpoint creates a new WordPress user account and assigns the administrator role, then returns a temporary login link bound to that account. An attacker holding only a Subscriber account, the lowest authenticated role in WordPress, can call the endpoint and obtain administrator-level access. This produces full read, write, and availability impact across the WordPress installation.
Root Cause
The root cause is a missing authorization check [CWE-862] inside the ctl_create_link AJAX handler. The plugin authenticates the requester via WordPress session cookies but does not verify that the requester holds the create_users or manage_options capability before provisioning a new administrator account.
Attack Vector
Exploitation requires authenticated access at the Subscriber level or above and is performed over the network against the WordPress admin-ajax.php endpoint. The attacker submits a POST request invoking the ctl_create_link action with parameters defining the new user. The plugin creates the administrator account and returns a temporary login link. The attacker follows the link, authenticates as the new administrator, and proceeds to install plugins, modify content, or upload arbitrary PHP for remote code execution.
The vulnerability mechanism is described in the Wordfence Vulnerability Analysis and the upstream fix in the WordPress Plugin Changeset.
Detection Methods for CVE-2025-10299
Indicators of Compromise
- Unexpected administrator accounts present in wp_users and wp_usermeta tables with recent user_registered timestamps
- POST requests to /wp-admin/admin-ajax.php containing action=ctl_create_link originating from Subscriber-level sessions
- New temporary login link entries generated by the plugin without corresponding administrator approval
- Successful logins from accounts whose creation time closely matches a ctl_create_link AJAX request
Detection Strategies
- Audit the WordPress user table for administrator accounts created after the plugin was installed and correlate creation events against access logs
- Inspect web server access logs for admin-ajax.php requests with the ctl_create_link action parameter issued by low-privilege users
- Monitor WordPress audit logs for user_register events combined with set_user_role changes assigning administrator
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record user creation, role changes, and AJAX action invocations
- Forward web server and WordPress logs to a centralized analytics platform and alert on ctl_create_link calls from non-administrator sessions
- Track plugin version inventory across WordPress estates to identify hosts still running WPBifröst 1.0.7 or earlier
How to Mitigate CVE-2025-10299
Immediate Actions Required
- Update the WPBifröst – Instant Passwordless Temporary Login Links plugin to a version later than 1.0.7 as soon as the vendor publishes a fixed release
- Deactivate and remove the plugin if a patched version is not yet available for your installation
- Audit all administrator accounts and remove any that cannot be attributed to a legitimate administrator action
- Force a password reset and session invalidation for all administrator accounts
Patch Information
The vendor addressed the issue via a code change tracked in the WordPress Plugin Changeset. Site administrators should install the latest version available on the WordPress Temporary Login Plugin page and verify the version number after upgrade.
Workarounds
- Restrict access to /wp-admin/admin-ajax.php for low-privileged roles by enforcing rules at a web application firewall when feasible
- Limit Subscriber role registration on the site to reduce the population of authenticated accounts able to invoke the endpoint
- Apply a must-use plugin that calls remove_action('wp_ajax_ctl_create_link', ...) to disable the vulnerable handler until the plugin is patched
# Verify the installed plugin version on a WordPress host
wp plugin get create-temporary-login --field=version
# Update the plugin once a patched release is available
wp plugin update create-temporary-login
# List administrator accounts and review for unauthorized entries
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
