Theme My Login Privilege Escalation Allows Unauthenticated Account Takeover
Unauthenticated attackers can reset passwords for any user in WordPress multi-site installations running vulnerable versions of the Theme My Login plugin.
Key points
- The flaw affects Theme My Login versions up to and including 7.2.1.
- National Vulnerability Database rates the issue as critical with a CVSS score of 9.8.
- Attackers do not need valid credentials to change arbitrary user passwords.
Unauthenticated threat actors can seize control of any user account on WordPress multi-site networks by exploiting a validation failure in the Theme My Login plugin. This privilege escalation vulnerability allows attackers to reset passwords for arbitrary users without prior authentication. The National Vulnerability Database assigns the flaw a critical severity rating of 9.8.
How it unfolded
- The National Vulnerability Database published record CVE-2026-89079 detailing the security flaw.
- The advisory identified that versions up to 7.2.1 fail to validate user identity before processing password updates.
- The weakness enables unauthenticated attackers to modify account credentials on multi-site WordPress configurations.
Who is affected
WordPress administrators managing multi-site installations are the primary targets for this vulnerability. The flaw specifically impacts environments running the Theme My Login plugin in versions 7.2.1 or earlier. Single-site installations may not be susceptible depending on their specific configuration, but multi-site setups face direct exposure. Any user account within the affected network can have its password changed by an external attacker who does not possess valid login credentials.
The fix
The source material does not confirm the availability of a patch or security update for this vulnerability. Administrators should monitor official channels from the plugin developer for a release that addresses the identity validation failure. Until a fix is available, organizations must rely on compensating controls to mitigate the risk of unauthorized account takeover.
What made it possible
This incident highlights the risks of improper identity verification during sensitive operations. When applications update critical account data like passwords without confirming the requester's identity, they create a direct path for privilege escalation. Security teams usually prioritize validating session tokens and user roles before allowing changes to authentication credentials. Check whether your systems enforce strict identity checks for all write operations, especially those that reset access controls or modify user permissions.
What to do and how to stay safe: Theme My Login
- Audit your WordPress installations to identify if Theme My Login is active and check its version number.
- Review server logs for unusual password reset requests originating from unauthenticated IP addresses.
- Restrict access to administrative interfaces using firewall rules or IP whitelisting where possible.
- Monitor for new security advisories from the plugin vendor regarding CVE-2026-89079.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Theme My Login are vulnerable?
Versions up to and including 7.2.1 are affected by this privilege escalation flaw.
Do attackers need a login to exploit this?
No, the vulnerability allows unauthenticated attackers to change passwords on multi-site setups.
Is there a CVSS score for this issue?
Yes, the National Vulnerability Database rates CVE-2026-89079 as critical with a 9.8 score.
