A critical authentication bypass in the WordPress Temporary Login Plugin versions up to 1.0.0 allows unauthenticated attackers to take over WordPress admin accounts.
Tracked as CVE-2026-7567, the bug lives in the temp-login-token parameter. By passing an empty array (?temp-login-token[]) to the wp-admin login page, an attacker can bypass the normal authentication flow entirely. The exploit was published on May 2, 2026, by researcher Amir Hossein Jamshidi.
The attack works by triggering a type juggling flaw in the token validation. If any temporary users exist on the site — which is common since the plugin creates them for support access — the attacker gets a valid WordPress session cookie. From there, they can log in as that user and potentially escalate privileges depending on the account’s assigned role.
Jamshidi’s proof of concept automates the whole thing. It sends a single GET request with the malformed token parameter, checks whether admin cookies were issued, and confirms admin dashboard access.
If you’re running this plugin, remove it immediately or upgrade to a patched version. Even if you’re not actively creating temporary accounts, the plugin likely has lingering entries from past support sessions.
