CVE-2026-77753 describes an improper access control vulnerability (CWE-284) in the Temporary Login Without Password WordPress plugin versions prior to 1.9.9. The plugin fails to prevent temporary users from creating Application Passwords and does not revoke these passwords after temporary access ends. Consequently, an attacker or user granted temporary access can continue to access the site through REST and XML-RPC APIs with the privileges assigned during the temporary login, typically Administrator-level, even after the administrator believes access has been revoked.

An attacker or temporary user can maintain unauthorized persistent access to the WordPress site beyond the intended temporary period. This continued access includes all permissions granted during the temporary login, potentially Administrator privileges, allowing full control over the site via REST and XML-RPC interfaces. This undermines the administrator's ability to revoke access and can lead to unauthorized site modifications or data exposure.

Upgrade the Temporary Login Without Password plugin to version 1.9.9 or later, where this issue is addressed. Since no patch links are provided, confirm the availability of the fix from the plugin vendor or official WordPress plugin repository before upgrading. Until patched, avoid using temporary logins or monitor and manually revoke any Application Passwords created by temporary users.