CVE-2026-77753: WordPress Temporary Login Auth Bypass Flaw

CVE-2026-77753 Overview

CVE-2026-77753 affects the Temporary Login Without Password WordPress plugin before version 1.9.9. The plugin fails to prevent temporary users from creating Application Passwords. It also does not revoke existing Application Passwords when the temporary access expires or is manually disabled. Recipients of temporary logins retain functional access to the site through the WordPress REST API and XML-RPC after administrators believe access has been withdrawn. The retained access preserves whatever role was originally granted, which in the plugin's primary use case is Administrator. This flaw falls under [CWE-284] Improper Access Control.

Critical Impact
Revoked temporary users can maintain persistent administrator-level access to WordPress sites via Application Passwords, bypassing intended access expiration controls.

Affected Products

Temporary Login Without Password WordPress plugin versions before 1.9.9
WordPress sites using the plugin to grant temporary administrator access
WordPress installations with REST API or XML-RPC endpoints enabled

Discovery Timeline

2026-09-12 - CVE-2026-77753 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-77753

Vulnerability Analysis

The Temporary Login Without Password plugin issues time-bound WordPress user accounts for support, development, or vendor access. When a temporary user authenticates through the plugin's magic link, WordPress treats the resulting session like any other authenticated session. That session can generate Application Passwords through the standard WordPress user profile or via wp-json/wp/v2/users/me/application-passwords. Application Passwords are independent authentication tokens designed for REST API and XML-RPC clients.

The plugin's lifecycle logic disables or deletes the temporary user record when the expiration window closes or when an administrator manually revokes access. That teardown does not enumerate and revoke Application Passwords tied to the account. As a result, previously issued tokens continue to authenticate against the REST API and XML-RPC surfaces with the original role attached, most commonly Administrator.

Root Cause

The root cause is incomplete access lifecycle management. The plugin does not restrict Application Password creation for accounts under its control, and it does not clean up authentication artifacts when revoking a temporary user. Administrators lack visibility into the parallel credential path, which is why revocation appears effective from the plugin's UI while access persists.

Attack Vector

An attacker with a valid temporary login logs in during the authorized window and generates one or more Application Passwords for their user account. When the administrator revokes the temporary login or the window expires, the attacker retains the Application Password. The attacker then authenticates over HTTP Basic Auth against wp-json endpoints or over XML-RPC using the retained credential. The exploitation requires privileged access at the time of issuance, which matches the plugin's intended trust model but is exceeded by the persistence outcome.

Refer to the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-77753

Indicators of Compromise

REST API or XML-RPC authentications from user accounts previously managed by the Temporary Login Without Password plugin after their expiration date
Application Password creation events (application-passwords REST endpoints or wp_create_application_password actions) originating from temporary user sessions
HTTP Basic authentication requests to /wp-json/ endpoints tied to disabled or deleted temporary accounts
Unexpected XML-RPC POST requests to xmlrpc.php from IP addresses associated with prior temporary support sessions

Detection Strategies

Audit the wp_user_meta table for entries with meta key _application_passwords associated with user IDs created by the plugin
Correlate WordPress authentication logs against the plugin's user creation and expiration records to identify surviving credentials
Enable and review WordPress audit logging plugins that record Application Password creation, use, and REST API calls

Monitoring Recommendations

Monitor for outbound content changes, plugin installs, or user role modifications performed via REST API after a temporary login window has closed
Alert on any Application Password authentication event whose associated user was created by the Temporary Login Without Password plugin
Track XML-RPC traffic volume and authentication patterns, particularly wp.getUsersBlogs and wp.newPost methods, from previously temporary accounts

How to Mitigate CVE-2026-77753

Immediate Actions Required

Update the Temporary Login Without Password plugin to version 1.9.9 or later on all WordPress installations
Enumerate all users created by the plugin and revoke any Application Passwords attached to them through the WordPress admin under Users → Profile → Application Passwords
Rotate credentials and review site content, users, and installed plugins for unauthorized changes made through REST API or XML-RPC channels
Delete stale temporary user accounts rather than only disabling them to remove residual authentication metadata

Patch Information

The plugin vendor addressed the issue in version 1.9.9. The fix prevents temporary users from creating Application Passwords and revokes existing Application Passwords when a temporary login expires or is disabled. See the WPScan Vulnerability Report for advisory details.

Workarounds

Disable Application Passwords site-wide using the wp_is_application_passwords_available filter until the plugin can be updated
Restrict REST API access to authenticated internal users and disable XML-RPC if not required by integrations
Manually query the database after each temporary login to purge _application_passwords user meta entries for expired accounts

bash

# Disable Application Passwords via must-use plugin (mitigation example)
# Save as wp-content/mu-plugins/disable-app-passwords.php
<?php
add_filter( 'wp_is_application_passwords_available', '__return_false' );