PT-2025-42292 · WordPress · Wpbifröst

Published 2025-10-15 · Updated 2025-10-15 · CVE-2025-10299

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPBifröst versions through 1.0.7

Description The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress has an issue that allows authenticated attackers with Subscriber-level access or higher to create new administrative user accounts. This is due to a missing capability check on the ctl create link AJAX action. Attackers can then log in as these newly created administrative users.

Recommendations Update to version 1.0.8.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-10299

Affected Products

Wpbifröst

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10299 · Security Note
• https://twitter.com/CVEnew/status/1978545126487240964 · Twitter Post
• https://wordpress.org/plugins/create-temporary-login · Note
• https://twitter.com/CveFindCom/status/1978380231271453082 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/50946bc7-8d31-4376-bdcc-de7aad700503?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379010%40create-temporary-login&new=3379010%40create-temporary-login&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/34969 · Telegram Post