WordPress Multisite Privilege Escalation via Temp Login Plugin

The Temporary Login Without Password WordPress plugin before 1.9.9 does not verify that the user requesting a temporary login holds network super admin rights before granting the new account those rights, allowing an administrator of a single site on a multisite network to take over the whole network. The same missing check also allows an existing account, including the attacker's own, to be promoted.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Temporary Login Without Password WordPress plugin before version 1.9.9 contains a critical privilege escalation vulnerability that allows site administrators to grant themselves network super admin rights on multisite installations. By exploiting missing authorization checks, an attacker with administrative access to even a single site can escalate to full network control, compromising all sites within the WordPress network. This vulnerability is particularly dangerous because it requires only standard admin credentials—a relatively low barrier to entry—yet yields complete infrastructure takeover. Organizations running WordPress multisite networks with this plugin are at high risk, especially if they employ multiple administrators or contractors with site-level access.

Casky's 224 matched skills detect the attack patterns associated with TA0004 (Privilege Escalation) by analyzing authorization bypass behaviors and account manipulation attempts. Practitioners using Casky would identify suspicious patterns such as unauthorized elevation of user roles, unexpected promotion of accounts to network administrator status, and API calls that bypass permission validation checks. The platform's Claude-powered extended reasoning maps these behavioral indicators to CWE-269 (Improper Access Control) signatures, flagging requests to grant elevated privileges without proper super admin verification. Security teams would see alerts on privilege escalation attempts, lateral movement across multisite network boundaries, and anomalous administrative account modifications—enabling them to detect and respond to exploitation attempts before full network compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-77752.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-77752

Casky has 224 skills that investigate the attack patterns behind CVE-2026-77752. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn