CVE-2026-83628 in Theme My Login Plugin
Summary
by MITRE • 09/05/2026
The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the `tml_ms_signup_handler()` function's `gimmeanotherblog` branch failing to enforce the network's `active_signup` registration policy, checking only `is_user_logged_in()` while sibling branches such as `validate-blog-signup` apply the full policy gate. This makes it possible for authenticated attackers, with Subscriber-level access and above, to directly POST `stage=gimmeanotherblog` to Theme My Login's signup route, bypassing the configured registration policy entirely — even when it is set to `none` or `user` — which causes `wpmu_create_blog()` to execute with the attacker's user ID, after which WordPress core assigns the Administrator role on the newly created subsite via `add_user_to_blog()`. The privilege gain is scoped to the newly created subsite only; the attacker's account retains Subscriber-level access on the main site and does not obtain Super Admin or network-level capabilities such as `manage_network` or `manage_sites`.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in Theme My Login versions up to 7.1.15 represents a critical authorization bypass within WordPress Multisite environments, specifically affecting the user registration workflow for creating additional subsites. This flaw stems from an inconsistent implementation of access control checks across different branches of the `tml_ms_signup_handler()` function. While other pathways such as `validate-blog-signup` correctly enforce the network's configured `active_signup` policy to restrict who can register new sites, the branch handling the `gimmeanotherblog` stage fails to perform this essential validation. Instead, it relies solely on a basic check for whether the user is logged in via `is_user_logged_in()`. This discrepancy allows any authenticated user with Subscriber-level privileges or higher to bypass administrative restrictions that are intended to limit site creation capabilities within the network.
From an operational perspective, this missing authorization enables attackers to exploit the registration endpoint by directly posting a request with `stage=gimmeanotherblog` to Theme My Login's signup route. By doing so, they circumvent the configured registration policy settings, which may be set to restrict registrations entirely or limit them to specific user roles. Once the validation is bypassed, the system proceeds to execute `wpmu_create_blog()`, creating a new subsite under the attacker's existing user ID. Following the creation of this site, WordPress core automatically assigns the Administrator role on that newly created subsite through the `add_user_to_blog()` function. This results in an immediate privilege escalation where the attacker gains full administrative control over the specific subsite they just created, despite having only low-level privileges on the main network site.
The impact of this vulnerability is significant for organizations relying on WordPress Multisite to manage multiple distinct sites under a single installation. Although the privilege gain is scoped strictly to the newly created subsite and does not grant Super Admin or network-wide capabilities such as `manage_network` or `manage_sites`, it still poses severe risks. An attacker can use this administrative access to install malicious plugins, modify site themes, exfiltrate data stored within that specific subsite, or pivot further into other parts of the infrastructure if proper isolation between sites is not strictly enforced at the server level. This effectively undermines the principle of least privilege and allows lower-level users to establish independent domains with elevated privileges without authorization from network administrators.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as well as CWE-862, Missing Authorization, because the application fails to verify that the user has the necessary permissions for the action being performed during the site creation process. In terms of offensive security frameworks, this behavior corresponds to MITRE ATT&CK techniques related to Account Manipulation and potentially Initial Access if combined with other vectors, as it allows an authenticated actor to escalate their privileges within a specific context. To mitigate this risk, administrators should immediately update Theme My Login to version 7.1.16 or later where the authorization checks have been corrected to align with network policies. Additionally, until patches are applied, restricting user registration capabilities at the WordPress core level and monitoring for unusual subsite creation activity can help detect exploitation attempts.