CVE-2026-7567
Published: 01 May 2026
Summary
CVE-2026-7567 is a critical-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
The Temporary Login plugin for WordPress is vulnerable to authentication bypass in versions up to and including 1.0.0. The flaw stems from missing input validation in the maybe_login_temporary_user() function, which does not ensure the 'temp-login-token' GET parameter is a scalar string. When an array is supplied, PHP's empty() check is bypassed, sanitize_key() returns an empty value, and get_users() with an empty meta_value returns all users that have the '_temporary_login_token' meta_key, enabling login without a valid token.
Unauthenticated attackers can exploit the issue over the network by sending a single crafted GET request containing an array value for the token parameter. Successful exploitation grants the attacker the ability to authenticate as any active temporary login user, resulting in full compromise of the affected account with high impact to confidentiality, integrity, and availability.
The EPSS score remains flat at 0.0592 with no material increase after disclosure. The listed references point to the vulnerable code paths in the plugin's admin.php and options.php files but contain no mitigation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26490
Vulnerability details
The Temporary Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.0.0. This is due to improper input validation in the maybe_login_temporary_user() function, which fails to verify that the 'temp-login-token' GET parameter is a…
more
scalar string before processing it. When the parameter is supplied as an array, PHP's empty() check is bypassed and sanitize_key() returns an empty string, which is then passed as the meta_value to get_users(). WordPress ignores an empty meta_value and returns all users matching the meta_key '_temporary_login_token', allowing authentication without a valid token. This makes it possible for unauthenticated attackers to authenticate as any active temporary login user by sending a single crafted GET request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an authentication bypass in a WordPress plugin, a public-facing web application, directly enabling unauthenticated remote exploitation for initial access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs (including GET parameters) to reject malformed data such as arrays before they reach authentication logic.
Enforces that access decisions are made only after successful, correctly implemented authentication rather than allowing bypass via unvalidated token input.
Requires reliable identification and authentication of non-organizational users, which the flawed temporary-login token handling violates.