This vulnerability (CVE-2026-7567) in the elemntor Temporary Login WordPress plugin arises from the maybe_login_temporary_user() function failing to verify that the 'temp-login-token' GET parameter is a scalar string. By supplying this parameter as an array, an attacker can bypass authentication checks and gain unauthorized access as any active temporary login user. The vulnerability affects versions up to and including 1.0.0 and has a CVSS 3.1 score of 9.8 (critical). No official patch or remediation guidance has been provided by the vendor at this time.

Successful exploitation results in a full authentication bypass, allowing an attacker to gain unauthorized access as any active temporary login user. This can lead to complete compromise of the affected WordPress site with high confidentiality, integrity, and availability impact.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, avoid using the affected plugin version or disable the Temporary Login plugin to prevent exploitation.