CVE-2026-77753
Medium
Description
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site over REST and XML-RPC after the administrator believes it has been withdrawn. The retained access carries whatever role was granted, which for the Temporary Login Without Password WordPress plugin before 1.9.9's main use case is Administrator.
SeverityMedium
CVSS5.5
Exploit probability—
ProductTemporary Login Without Password
PublishedSep 12, 2026
First seenSep 12, 2026
Weakness typeCWE-284Improper access control
How to fix
Update
- Temporary Login Without Password1.9.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Temporary Login Without Password | v < 1.9.9 | 1.9.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.