Answer in brief
CVE-2026-77753 records a Unknown severity vulnerability in Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords. The current sources do not mark it as known exploited. The current feed maps Unknown/Temporary Login Without Password (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Temporary Login Without Password (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Temporary Login Without Passwordgeneric | >=0 <1.9.9 | 1.9.9 |
Published upstream
Sep 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 12, 2026
The Temporary Login Without Password WordPress plugin before 1.9.9 does not prevent a temporary user from creating an Application Password, and does not revoke one when the temporary access expires or is disabled, allowing the recipient of a temporary login to retain working access to the site over REST and XML-RPC after the administrator believes it has been withdrawn. The retained access carries whatever role was granted, which for the Temporary Login Without Password WordPress plugin before 1.9.9's main use case is Administrator.
Quoted source text, attributed separately from HOL analysis.