CVE-2021-24836

CVE-2021-24836 describes a vulnerability in the Temporary Login Without Password WordPress plugin prior to version 1.7.1, where it lacks authorization and CSRF checks for updating its settings. This medium-severity vulnerability (CVSS 4.3) allows any logged-in user, including subscribers, to modify plugin settings, potentially leading to unauthorized configuration changes. While the attack complexity is low and no user interaction is required, the impact is limited to integrity, with no confidentiality or availability concerns. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.