Can you explain this vulnerability to me?

The Temporary Login plugin for WordPress has an authentication bypass vulnerability in versions up to and including 1.0.0. This occurs because the function maybe_login_temporary_user() does not properly validate the 'temp-login-token' GET parameter. Specifically, it fails to check that this parameter is a scalar string before processing it.

If an attacker supplies the 'temp-login-token' parameter as an array, PHP's empty() check is bypassed and sanitize_key() returns an empty string. This empty string is then used as the meta_value in a call to get_users(). Since WordPress ignores an empty meta_value, it returns all users matching the meta_key '_temporary_login_token'.

As a result, an unauthenticated attacker can authenticate as any active temporary login user by sending a single crafted GET request with the 'temp-login-token' parameter as an array.

Useful 0 Not Useful 0

How can this vulnerability impact me? :

This vulnerability allows unauthenticated attackers to bypass authentication and gain access to a WordPress site as any active temporary login user.

Because the attacker can impersonate legitimate users without valid credentials, they can potentially access sensitive information, modify site content, or perform administrative actions depending on the privileges of the temporary login user.

The CVSS score of 9.8 indicates a critical severity with high impact on confidentiality, integrity, and availability.

Useful 0 Not Useful 0