Horizon Alert
Summary of the vulnerability and why it matters
An issue in the Temporary Login plugin for WordPress allows anyone to log in as any user without needing a valid token. This happens because the plugin doesn't properly check the login token before using it, potentially letting unauthorized individuals access accounts.
- Attackers can bypass login requirements.
- Any active temporary login user could be impersonated.
- The vulnerability is reachable from the internet.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can bypass authentication by exploiting a flaw in the Temporary Login plugin. By sending a crafted GET request with the 'temp-login-token' parameter as an array, the plugin's validation fails, allowing the attacker to authenticate as any user with a temporary login token set. This effectively grants them access to the site as that user without needing a valid token.
- Unauthenticated access required.
- Target plugin's temporary login function.
- Exploitable via crafted GET request.
Live Threat
Current exploitation, exposure, and threat context
This critical vulnerability in a WordPress login plugin allows unauthenticated attackers to bypass authentication and log in as any user. Attackers are likely to weaponize this because it targets a popular content management system, offers easy remote exploitation, and impacts authentication directly.
- Affects widely used WordPress.
- Exploits an authentication bypass flaw.
- Easy remote unauthenticated access.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize identifying and blocking any traffic attempting to exploit the Temporary Login plugin's authentication bypass vulnerability by sending an array for the 'temp-login-token' parameter. This critical vulnerability allows unauthenticated attackers to log in as any temporary login user, posing a severe risk to all WordPress sites using versions up to 1.0.0.
- Block requests with non-scalar 'temp-login-token' parameters.
- Update the Temporary Login plugin to a patched version.
- Monitor for unauthorized logins via temporary tokens.
