The Bifröst – Instant Passwordless Temporary Login Links plugin for WordPress contains a missing capability check on the ctl_create_link AJAX action. Because of this flaw, any authenticated user with Subscriber-level access or higher can invoke the action to create new administrative accounts. The attacker can then log in as those users, resulting in privilege escalation and full control over the site. This vulnerability is categorized as CWE‑862, Missing Authorization.

WordPress sites that have the Bifröst – Instant Passwordless Temporary Login Links plugin installed with version 1.0.7 or earlier. The flaw applies to all supported versions up to and including 1.0.7. Sites using newer releases are not affected.

The CVSS score of 8.8 indicates a high risk. The EPSS score of less than 1% suggests that the probability of exploitation observed in the environment is low, and the vulnerability is not listed in CISA’s KEV catalog. However, exploitation requires only an existing authenticated user with Subscriber or higher privileges, so an attacker can simply send a crafted request to the ctl_create_link endpoint to create an admin account. Once an administrative account is created, the attacker can authenticate as that user and gain full control. Because the attack vector is internal but does not require elevated permissions beyond a subscriber, the vulnerability is easily exploitable by any logged‑in user on the site.