The vulnerability arises from improper validation of the 'temp-login-token' GET parameter within the Temporary Login plugin for WordPress. It allows an unauthenticated attacker to supply the parameter as an array, causing PHP’s empty() check to fail and sanitize_key() to return an empty string. This empty string is then used as the meta_value in a call to get_users(), leading WordPress to return all users with the meta_key '_temporary_login_token'. The attacker can thus authenticate as any active temporary login user without a valid token. The weakness is classified as CWE-288 (Authorization Bypass Through User-Controlled Key). The result is complete account takeover of temporary login users, compromising confidentiality, integrity, and potentially leading to broader site compromise.

WordPress sites that have the Temporary Login plugin (elemntor:Temporary Login) installed, specifically any version up to and including 1.0.0.

The vulnerability scores a CVSS of 9.8, indicating a critical risk level. EPSS information is not available, but the lack of a KEV listing does not diminish the potential for widespread exploitation, given the plugin’s popularity and the ease of crafting the required GET request. The attack can be performed by anyone with internet access to the host, requiring no authentication or privileged credentials. An attacker only needs to send a single crafted request with the 'temp-login-token' parameter set as an array to bypass authentication and assume the identity of any temporary login user.