Temporary Login
Temporary Login has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 9.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.
The most common weakness is Authentication Bypass Using An Alternate Path Or Channel, behind 1 of the records (100%).
The one issue recorded for Temporary Login has a vendor fix available, so running the current release closes it.
All of these findings were reported by TANG Cheuk Hei (siunam). Temporary Login is installed on roughly 40,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2026-7567Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover
Read the full analysisVulnerability Records
Temporary Login
Author
Elementor
Temporary Login creates a secure, temporary URL for easy access to your WP admin with no username and password. Share this URL with trusted support agents and colleagues in order to resolve issues quickly, and shut down access as soon as you’re done. FEATURES Grant access to your site with a single click; a temporary URL will be created that you can share for admin-level access to your site and it will automatically expire 7 days from creation. Extend access – need more time? No problem. Just click to extend access so that users don’t get locked out. All done? Revoke access and the link becomes inaccessible. Auto disable access – whether you forget to revoke access or lose track of the timing, there’s no need to worry. We will automatically disable the access URL at the expiration, within 7 days. CONTRIBUTION Would you like to contribute to this plugin? You’re more than welcome to submit your pull requests on the GitHub repo. Also, if you have any notes about the code, please open a ticket on the issue tracker.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C