CVE-2026-77752 is a privilege escalation vulnerability in the Temporary Login Without Password WordPress plugin versions 1.5 up to but not including 1.9.9. The plugin does not properly check whether the user requesting a temporary login has network super admin rights before granting such rights. This improper privilege management (CWE-269) enables a single-site administrator on a multisite WordPress network to gain network-wide super admin privileges, effectively taking over the entire network. The same missing verification also allows an attacker to promote existing accounts to network super admin.

An attacker with administrator privileges on a single site within a multisite WordPress network can escalate their privileges to network super admin. This results in full control over the entire multisite network, including all sites and user accounts. The vulnerability also allows promotion of existing accounts to network super admin, increasing the risk of unauthorized access and control.

Upgrade the Temporary Login Without Password plugin to version 1.9.9 or later, where this privilege verification issue is fixed. Until patched, restrict administrator access on multisite networks to trusted users only. Patch status is not explicitly confirmed in the input data, but the presence of a fixed version (1.9.9) implies an official fix is available in that version.