CVE-2026-81583 in My Login Plugin
Summary
by MITRE • 09/02/2026
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in My Login WordPress plugin versions prior to 7.2.0 represents a critical failure in access control logic within multisite environments. This flaw stems from the application's inability to properly validate user permissions against the network-wide registration settings when processing site signup requests. In a standard WordPress Multisite configuration, administrators can restrict who is allowed to register new sites or create accounts based on their current role and authentication status. However, due to this implementation error, the plugin bypasses these restrictions, effectively ignoring the administrative policies designed to limit self-registration capabilities. This lack of enforcement allows individuals with minimal privileges, such as subscriber-level users, to initiate and complete site creation processes that should be restricted to higher-privileged roles or disabled entirely for unauthenticated visitors depending on network configuration.
From a technical perspective, this issue classifies under CWE-269 Improper Privilege Management because the software fails to enforce required security boundaries between different user levels. The root cause lies in how the plugin handles the signup endpoint logic without cross-referencing it against the global WordPress multisite settings that dictate registration permissions. Consequently, an attacker with a low-level subscriber account can exploit this gap to provision new sub-sites within the network. Furthermore, on networks where unauthenticated users are permitted to register accounts under specific conditions, this vulnerability allows even non-logged-in individuals to create sites and automatically gain administrative control over them. This escalation of privilege is particularly dangerous as it grants full control over a distinct site instance without requiring elevated initial credentials or exploiting complex code injection flaws.
The operational impact of this vulnerability is severe for organizations relying on WordPress Multisite for hosting multiple independent websites under a single administration umbrella. By allowing unauthorized users to create sites and assume administrator roles, the integrity of the entire network infrastructure is compromised. Attackers can use these newly created administrative accounts to install malicious plugins or themes, deface content, exfiltrate sensitive data stored within those specific site databases, or pivot further into other parts of the network if lateral movement opportunities exist. This undermines the principle of least privilege and creates significant compliance risks for entities subject to regulatory frameworks requiring strict access controls and auditability. The ability for unauthenticated users to gain administrative rights also exposes the organization to potential ransomware attacks or botnet recruitment through compromised site instances.
To mitigate this risk, administrators must immediately upgrade the My Login plugin to version 7.2.0 or later where these permission checks have been corrected. Until an update is applied, it is advisable to disable any functionality related to self-registration if not strictly necessary for business operations. Additionally, security teams should audit existing multisite installations for unauthorized site creations and review user role assignments to ensure no malicious administrative accounts were established during the window of vulnerability. Implementing Web Application Firewall rules that monitor for unusual patterns in signup endpoints can also provide a layer of defense against exploitation attempts while patching is underway. Regularly reviewing WordPress core updates and plugin changelogs remains essential to maintaining a secure posture, as this incident highlights how seemingly minor permission logic errors can lead to significant security breaches.