What’s Vulnerable › Vulnerabilities
CVE-2026-77752: Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-12 · updated 2026-09-14
- Weakness: CWE-269
Description
The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole network. The same missing check also allows an existing account, including the attacker's own, to be promoted.
Affected products
- Temporary Login Without Password: from 1.5 before 1.9.9 — fixed in 1.9.9
How to fix
Upgrade to a fixed version: Temporary Login Without Password 1.9.9. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-77752 or the next vulnerability affects your stack