CVE-2026-89079 in Theme My Login Plugin
Summary
by MITRE • 10/16/2026
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified within Theme My Login versions up to and including 7.2.1 represents a critical security flaw rooted in the failure of proper identity validation during password reset operations. This issue specifically affects WordPress multisite installations where specific configuration settings are enabled, allowing unauthenticated actors to bypass standard authentication protocols. The core technical deficiency lies in the plugin's handling of user account recovery mechanisms, which do not sufficiently verify that the entity requesting a password change is indeed the legitimate owner of the target account or possesses valid administrative privileges for such an action. By neglecting robust identity verification steps prior to executing credential updates, the software creates a direct pathway for privilege escalation through account takeover.
From a technical perspective, this flaw aligns with CWE-287, which describes Improper Authentication, and more specifically CWE-640, Weak Password Recovery Mechanism for Administrator Account. The vulnerability exploits the trust placed in user-provided identifiers during the reset process without enforcing secondary verification factors or strict session validation. In a multisite environment, where administrative control is often centralized but distributed across multiple sites, this lack of rigorous checks allows an attacker to target high-privilege accounts such as super administrators. By manipulating the request parameters associated with password updates, an unauthenticated user can effectively hijack these critical accounts without needing prior access credentials or knowledge of existing passwords.
The operational impact of this vulnerability is severe due to the potential for complete system compromise. Once an attacker successfully changes the password of a privileged account, they gain full control over that user profile and any associated resources within the WordPress multisite network. This includes the ability to modify site configurations, install malicious plugins or themes, exfiltrate sensitive data from users across all sites in the network, and further propagate malware throughout the infrastructure. The ease with which this can be achieved by an unauthenticated attacker significantly lowers the barrier for entry, making it a high-risk vector for widespread exploitation against WordPress-based enterprises that rely on multisite architectures for their digital presence.
To mitigate this risk, immediate action is required to update the Theme My Login plugin to version 7.2.2 or later, where these validation checks have been corrected. Administrators should also review their server logs for any suspicious activity indicative of attempted password resets targeting administrative accounts prior to applying the patch. Implementing additional security layers such as two-factor authentication for all user accounts, particularly those with elevated privileges, can provide a crucial defense-in-depth measure that remains effective even if application-level vulnerabilities are present. Furthermore, restricting access to login and recovery endpoints via IP whitelisting or Web Application Firewall rules can help reduce the attack surface available to unauthenticated actors until the software is fully patched across all instances of the multisite network.