A high-severity privilege escalation vulnerability in the Temporary Login Without Password plugin allows an authenticated site administrator to compromise an entire WordPress multisite network.

The plugin suffers from improper privilege management (CWE-269) because it fails to verify if a user requesting a temporary login possesses network super admin rights. Consequently, any authenticated administrator on a single site can elevate their own account or other accounts to super admin status, granting full control over the network.

Successful exploitation leads to a total compromise of the WordPress multisite environment, as an attacker gains full administrative control over all sites within the network. This represents a critical risk to data confidentiality, integrity, and availability. Given the CVSS score of 7.2, organizations must treat this as a high-priority incident to prevent unauthorized lateral movement and full system takeover.

Immediate Action: Update the Temporary Login Without Password plugin to version 1.9.9 or later immediately.

Proactive Monitoring: Review WordPress user account logs and audit trails for unexpected changes in user roles, particularly the elevation of standard accounts to network super admin status.

Compensating Controls: If an immediate update is not feasible, temporarily deactivate the plugin and audit existing administrative accounts for any unauthorized modifications or newly created accounts.

Public Exploit Available: Unknown.

The risk of network-wide compromise posed by this vulnerability is significant for any organization utilizing WordPress multisite configurations. Security teams should prioritize the application of the 1.9.9 patch across all affected instances to eliminate the privilege management flaw. Failure to remediate this issue could allow a single compromised site administrator to seize control of the entire organizational web infrastructure.