CVE-2026-77753 — MEDIUM (5.5)

Vulnerability Description

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site over REST and XML-RPC after the administrator believes it has been withdrawn. The retained access carries whatever role was granted, which for the Temporary Login Without Password WordPress plugin before 1.9.9's main use case is Administrator.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-284

References

https://wpscan.com/vulnerability/9424fd42-5c77-41a9-a1fb-db568126515e/

FAQ

What is CVE-2026-77753?

CVE-2026-77753 is a vulnerability with a CVSS score of 5.5 (MEDIUM). The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or...

How severe is CVE-2026-77753?

CVE-2026-77753 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-77753?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.