CVE-2026-7567 is an authentication bypass vulnerability in the Temporary Login WordPress plugin (elemntor) versions up to 1.0.0. The issue arises from improper input validation in the maybe_login_temporary_user() function, which fails to ensure the 'temp-login-token' GET parameter is a scalar string. When an attacker supplies this parameter as an array, PHP's empty() check is bypassed, and sanitize_key() returns an empty string. WordPress then ignores the empty meta_value and returns all users matching the meta_key '_temporary_login_token', allowing authentication without a valid token. This enables unauthenticated attackers to log in as any active temporary login user via a single crafted GET request.

Successful exploitation allows unauthenticated attackers to bypass authentication and gain access as any active temporary login user. This compromises confidentiality, integrity, and availability of the affected WordPress site. The vulnerability is critical with a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on all security properties.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the affected versions of the Temporary Login plugin or disable the plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.