CVE-2026-77752 Overview
CVE-2026-77752 is a privilege escalation vulnerability [CWE-269] in the Temporary Login Without Password WordPress plugin before version 1.9.9. The plugin fails to verify that the user requesting a temporary login holds network super admin rights before granting those rights to a new account. An administrator of a single site on a multisite network can create a temporary login with super admin privileges and take over the entire network. The same missing check allows an existing account, including the attacker's own, to be promoted to super admin.
Critical Impact
A site-level administrator on a WordPress multisite network can escalate to network super admin, compromising every site in the network.
Affected Products
- Temporary Login Without Password WordPress plugin versions prior to 1.9.9
- WordPress multisite installations running the affected plugin
- Sites where the plugin is active with at least one site-level administrator account
Discovery Timeline
- 2026-09-12 - CVE-2026-77752 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-77752
Vulnerability Analysis
The Temporary Login Without Password plugin lets administrators generate short-lived login links for third parties. In a WordPress multisite environment, roles operate at two tiers: site-level administrators manage a single site, and network super admins control the entire network. The plugin's temporary account creation flow does not enforce this separation. When a request specifies that the temporary account should receive super admin capabilities, the plugin honors it without checking whether the requester already holds those capabilities.
The same missing authorization check applies to role assignment on existing accounts. An attacker with site-level administrator access can promote their own account, or any other account, to super admin. Once promoted, the attacker controls user management, plugin installation, and content across every site in the multisite network.
Root Cause
The root cause is a missing capability check in the code path that assigns network-level privileges. The plugin trusts input from any authenticated administrator instead of validating that the caller holds the manage_network capability. This matches the [CWE-269] Improper Privilege Management pattern, where authorization logic accepts a privilege escalation request without verifying the requester's authority to make it.
Attack Vector
Exploitation requires an authenticated site-level administrator account on a multisite network running the vulnerable plugin. The attacker submits a request to the plugin's temporary login endpoint specifying super admin role assignment. The plugin creates the account or promotes the target account without checking the requester's network privileges. The attacker then authenticates as the promoted user and gains full control of the multisite network. Technical details are available in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-77752
Indicators of Compromise
- Unexpected new entries in the wp_sitemeta table under the site_admins option indicating unauthorized super admin promotions
- Temporary login accounts created by site-level administrators with elevated network capabilities
- Existing user accounts appearing in the network super admin list without corresponding administrative approval
- Plugin audit logs showing temporary login generation requests originating from non-super-admin users
Detection Strategies
- Enumerate all super admin accounts and correlate their creation or promotion time with plugin activity in web server logs
- Monitor HTTP requests to the Temporary Login Without Password plugin endpoints for role or capability parameters requesting super admin rights
- Compare the current site_admins list against a known-good baseline and alert on additions
Monitoring Recommendations
- Enable WordPress audit logging plugins to record role changes and user creation events across the multisite network
- Forward WordPress and web server logs to a centralized SIEM for correlation with authentication events
- Alert on any use of the grant_super_admin() function or direct writes to the site_admins sitemeta option
How to Mitigate CVE-2026-77752
Immediate Actions Required
- Update the Temporary Login Without Password plugin to version 1.9.9 or later on every site in the multisite network
- Audit the current super admin list and revoke any accounts that were not explicitly authorized
- Review all active temporary login accounts and revoke any with elevated privileges
- Rotate credentials and session tokens for accounts suspected of unauthorized promotion
Patch Information
The vendor addressed the vulnerability in version 1.9.9 of the Temporary Login Without Password plugin by adding a capability check that verifies the requesting user holds network super admin rights before granting those rights to a new or existing account. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the Temporary Login Without Password plugin across the multisite network until the update is applied
- Restrict site-level administrator accounts to trusted personnel and reduce the number of administrators on multisite installations
- Apply a Web Application Firewall rule to block requests to plugin endpoints that contain super admin role parameters from non-network-admin sessions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.