WPBifröst WordPress Plugin Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress, affecting all versions through 1.0.7. The vulnerability arises from a missing capability check on the ctl_create_link AJAX action, allowing authenticated attackers with Subscriber-level access and above to create new administrative user accounts and log in as those users.

Impact

Exploitation of this vulnerability allows authenticated users with Subscriber-level access and above to create administrative accounts and log in as those users.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.