Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-77753 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site over REST and XML-RPC after the administrator believes it has been withdrawn. The retained access carries whatever role was granted, which for the Temporary Login Without Password WordPress plugin before 1.9.9's main use case is Administrator.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CNA: CISA-ADPCVSS-B:5.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://wpscan.com/vulnerability/9424fd42-5c77-41a9-a1fb-db568126515e/	[email protected]	AdvisoryExploitRemedy

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-284	Improper Access Control	CISA-ADP

Affected Products

Product	Versions
Temporary Login Without Password	< 1.9.9 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 1.9.9moderate effort

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 12, 2026	CVE Modified	CISA-ADP
Sep 12, 2026	New CVE Received	[email protected]