CVE-2026-77752
Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole network. The same missing check also allows an existing account, including the attacker's own, to be promoted.
| Vendor | unknown |
| Product | temporary login without password |
| Published | Sep 12, 2026 |
| Last Updated | Sep 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown temporary login without password
Be the first to know when new high vulnerabilities affecting unknown temporary login without password are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Temporary Login Without Password
1.5 < 1.9.9
References
Credits
BaptouTatis WPScan