The Temporary Login plugin for WordPress up to and including version 1.0.0 contains an authentication bypass vulnerability. This flaw arises from improper input validation in the maybe_login_temporary_user() function, which allows an attacker to bypass token verification by supplying the 'temp-login-token' GET parameter as an array. This causes WordPress to return all users with the '_temporary_login_token' meta_key, enabling unauthenticated attackers to log in as any active temporary login user with a crafted GET request.