The Temporary Login Without Password WordPress plugin...
Moderate severity
Unreviewed
Published
Dec 14, 2021
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Description
Published by the National Vulnerability Database
Dec 13, 2021
Published to the GitHub Advisory Database
Dec 14, 2021
Last updated
Jan 27, 2023
The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them
References