Introduction
If the WPBifröst plugin is present and unpatched, an attacker with only Subscriber-level access to a WordPress site can gain full administrative control. The flaw affects any site running WPBifröst up to version 1.0.7. A missing authorization check in an AJAX handler allows privilege escalation and complete site takeover.
WPBifröst – Instant Passwordless Temporary Login Links is a WordPress plugin that simplifies temporary access management by generating passwordless login links. It is distributed through the official WordPress plugin repository. Site administrators use it so they do not have to share permanent credentials.
Technical Information
The vulnerability is in the ctl_create_link AJAX action handler of the WPBifröst plugin. In all versions up to and including 1.0.7, this handler processes requests to create temporary login links without checking the requesting user's capabilities. It never calls WordPress's current_user_can() or an equivalent capability-checking function.
An authenticated user (Subscriber-level or higher) can send a crafted AJAX POST request to admin-ajax.php with the action parameter set to ctl_create_link. If the request parameters specify the Administrator role, the plugin generates a temporary login link that grants administrative access when used. The plugin processes the request without checking whether the user is authorized to create such links, so a Subscriber can escalate to Administrator.
This is a textbook case of CWE-862 (Missing Authorization), in which an application performs a sensitive action without checking that the user has the required permissions. The flaw is most severe on sites with open registration, where an attacker can simply register as a Subscriber and escalate from there.
No public code snippets are available for the vulnerable handler, but multiple security advisories confirm the exploitation method.
Affected Systems and Versions
- Product: WPBifröst – Instant Passwordless Temporary Login Links (WordPress plugin)
- Affected versions: All versions up to and including 1.0.7
- Vulnerable configuration: Any WordPress site with the plugin installed and activated, regardless of registration settings. Sites with open registration are at higher risk.
Vendor Security History
- No public record of previous vulnerabilities in WPBifröst.
- No information is available on the vendor's patch response time or security maturity.
