CVE-2026-7567

The record

The Temporary Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.0.0. This is due to improper input validation in the maybe_login_temporary_user() function, which fails to verify that the 'temp-login-token' GET parameter is a scalar string before processing it. When the parameter is supplied as an array, PHP's empty() check is bypassed and sanitize_key() returns an empty string, which is then passed as the meta_value to get_users(). WordPress ignores an empty meta_value and returns all users matching the meta_key '_temporary_login_token', allowing authentication without a valid token. This makes it possible for unauthenticated attackers to authenticate as any active temporary login user by sending a single crafted GET request.

Affected packages

Related vulnerabilities

• CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper… CWE-288
• CVE-2026-96387 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop… CWE-288
• CVE-2026-96385 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST &… CWE-288
• CVE-2026-84923 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email… CWE-288
• CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in… CWE-288
• CVE-2026-81906 Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an… CWE-288
• CVE-2026-81787 Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. CWE-288
• CVE-2026-81783 Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions. CWE-288