Temporary Login Without Password
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:temporary_login_without_password:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Temporary Login Without Password (7cd6d00c-87c2-59ff-bef8-71c8635fae7c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-77753 |
vulnerable | 2026-09-16 04:32:40.550420 |
Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site over REST and XML-RPC after the administrator believes it has been withdrawn. The retained access carries whatever role was granted, which for the Temporary Login Without Password WordPress plugin before 1.9.9's main use case is Administrator.
Published: 2026-09-12T06:00:08.293Z
Updated: 2026-09-12T15:35:08.098Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-77752 |
vulnerable | 2026-09-16 04:32:40.495027 |
Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation
The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole network. The same missing check also allows an existing account, including the attacker's own, to be promoted.
Published: 2026-09-12T06:00:08.118Z
Updated: 2026-09-12T15:35:23.105Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24836 |
vulnerable | 2026-06-08 05:30:39.327428 |
Temporary Login Without Password < 1.7.1 - Subscriber+ Plugin's Settings Update
The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them
Published: 2021-12-13T10:41:04.000Z
Updated: 2024-08-03T19:42:17.472Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.