CVE-2026-77753

Name of the Vulnerable Software and Affected Versions Temporary Login Without Password versions prior to 1.9.9

Description The plugin fails to prevent temporary users from creating an Application Password and does not revoke these passwords when temporary access expires or is disabled. This allows a user to maintain access to the site via REST and XML-RPC interfaces after their temporary access has been withdrawn. The persistent access retains the assigned user role, which is typically Administrator.

Recommendations Update to version 1.9.9 or later.