CVE-2026-7567: WordPress Temporary Login Plugin Critical Auth Bypass

A critical authentication bypass vulnerability, identified as CVE-2026-7567, has been discovered in the Temporary Login plugin for WordPress, affecting versions up to and including 1.0.0. The National Vulnerability Database reports this flaw stems from improper input validation within the maybe_login_temporary_user() function. Specifically, the function fails to verify that the temp-login-token GET parameter is a scalar string.

When an attacker supplies the temp-login-token parameter as an array, PHP’s empty() check is bypassed. This causes sanitize_key() to return an empty string, which is then passed as the meta_value to get_users(). WordPress, as noted by the National Vulnerability Database, ignores an empty meta_value when retrieving users, effectively returning all users matching the _temporary_login_token meta key. This allows unauthenticated attackers to log in as any active temporary user with a single crafted GET request, completely sidestepping token validation.

This vulnerability carries a CVSS score of 9.8 (Critical), making it an immediate and severe threat. It represents a complete compromise of authentication for affected WordPress sites utilizing this plugin, granting attackers full control over temporary user accounts. Defenders must understand that this isn’t a theoretical risk; it’s a straightforward, unauthenticated path to unauthorized access.