jfarthing84 Theme My Login Plugin up to 7.1.15 on WordPress tml_ms_signup_handler stage improper authorization

Summaryinfo

A vulnerability categorized as problematic has been discovered in jfarthing84 Theme My Login Plugin up to 7.1.15. The affected element is the function tml_ms_signup_handler. Such manipulation of the argument stage leads to improper authorization. This vulnerability is listed as CVE-2026-83628. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in jfarthing84 Theme My Login Plugin up to 7.1.15 and classified as problematic. Affected by this issue is the function tml_ms_signup_handler. The manipulation of the argument stage with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity. CVE summarizes:

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the `tml_ms_signup_handler()` function's `gimmeanotherblog` branch failing to enforce the network's `active_signup` registration policy, checking only `is_user_logged_in()` while sibling branches such as `validate-blog-signup` apply the full policy gate. This makes it possible for authenticated attackers, with Subscriber-level access and above, to directly POST `stage=gimmeanotherblog` to Theme My Login's signup route, bypassing the configured registration policy entirely — even when it is set to `none` or `user` — which causes `wpmu_create_blog()` to execute with the attacker's user ID, after which WordPress core assigns the Administrator role on the newly created subsite via `add_user_to_blog()`. The privilege gain is scoped to the newly created subsite only; the attacker's account retains Subscriber-level access on the main site and does not obtain Super Admin or network-level capabilities such as `manage_network` or `manage_sites`.

The advisory is available at wordfence.com. This vulnerability is handled as CVE-2026-83628 since 08/31/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/05/2026). This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• jfarthing84

Name

• Theme My Login Plugin

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.1.8
• 7.1.9
• 7.1.10
• 7.1.11
• 7.1.12
• 7.1.13
• 7.1.14
• 7.1.15

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion