Attack Chain

1. An unauthenticated attacker identifies a WordPress site using the vulnerable Temporary Login plugin (version <= 1.0.0).
2. The attacker crafts a malicious GET request targeting the WordPress site’s login endpoint, including the ’temp-login-token’ parameter as an array (e.g., temp-login-token[]=).
3. The web server receives the GET request.
4. The maybe_login_temporary_user() function processes the request.
5. Due to improper input validation, the empty() check is bypassed when the ’temp-login-token’ parameter is an array.
6. sanitize_key() processes the array and returns an empty string as the meta_value.
7. WordPress executes a database query using the empty meta_value, effectively retrieving all users with active temporary login tokens.
8. The attacker is granted unauthorized access to the account of a targeted temporary user, bypassing normal authentication procedures.

Impact

Successful exploitation of CVE-2026-7567 allows unauthenticated attackers to bypass login restrictions and gain unauthorized access to WordPress user accounts utilizing the vulnerable Temporary Login plugin. The severity is high, as it allows complete compromise of user accounts without requiring any valid credentials. The impact includes potential data theft, account takeover, website defacement, and other malicious activities, depending on the privileges of the compromised user account.

Recommendation

• Apply the available patch or upgrade the Temporary Login plugin to a version greater than 1.0.0 to remediate CVE-2026-7567.
• Deploy the Sigma rule Detect WordPress Temporary Login Authentication Bypass Attempt to detect exploitation attempts by monitoring HTTP requests with array-based temp-login-token parameters in the query string.
• Implement input validation on the web server to reject requests containing array-based parameters where scalar strings are expected.