Does Your WordPress Network Need Immediate Patching for Critical Theme My Login Vulnerability?

The Theme My Login plugin for WordPress contains a severe security flaw that allows attackers to take over user accounts without authentication. According to the National Vulnerability Database, this issue affects versions up to and including 7.2.1. The vulnerability enables unauthenticated attackers to change the passwords of arbitrary users on multi-site installations. This capability effectively grants attackers full control over targeted accounts, bypassing standard security checks.

How does the vulnerability work?

The flaw stems from insufficient identity validation before password updates are processed. The plugin fails to properly verify a user's identity prior to allowing changes to their account credentials. This lack of validation creates a pathway for privilege escalation. Attackers do not need existing login credentials to exploit this weakness. They can target any user account within a multi-site setup that uses the vulnerable plugin version.

Which environments are at risk?

The vulnerability specifically impacts WordPress multi-site configurations. The National Vulnerability Database notes that the issue arises in certain configurations within these setups. Single-site installations may not be affected in the same manner, but multi-site networks face significant exposure. Any WordPress installation running Theme My Login version 7.2.1 or earlier is considered vulnerable. The weakness is classified under CWE-269, which relates to improper privilege management.

What is the severity rating?

Security researchers have assigned a CVSS score of 9.8 to this flaw. The National Vulnerability Database categorizes this score as critical. This high rating reflects the ease of exploitation and the severe impact of account takeover. The vulnerability allows for complete unauthorized access to user accounts. No authentication is required to initiate the attack, making it accessible to any remote attacker who can reach the site.

Is a fix available yet?

The source material does not confirm the release of a patch or update. Users should assume that versions up to 7.2.1 remain vulnerable. Without a confirmed fix, administrators must rely on mitigation strategies. Monitoring for official announcements from the plugin developer is essential. Until a secure version is released, the risk of account compromise remains high for affected installations.

What analysts watch for

Teams usually examine server logs for unusual password reset requests originating from unknown IP addresses. Analysts check for rapid succession of credential changes across multiple user accounts. They look for spikes in traffic to the plugin's authentication endpoints. Reviewing database entries for unexpected user modifications helps identify successful exploitation. Monitoring for new administrative accounts created shortly after suspicious activity is also standard practice. These indicators suggest active abuse of identity validation flaws.

Background: CVSS score

The CVSS score provides a standardized number to rank vulnerability severity. Small teams should use it to prioritize patches, but must adjust for business context. A high score does not always mean immediate danger if the affected component is isolated or unused.

Read the full guide: CVSS Scores Explained: What Small Teams Must Know

What to do and how to stay safe: Theme My Login

• Review WordPress logs for unauthorized password change attempts.
• Disable the Theme My Login plugin if you cannot verify a secure update.
• Monitor user accounts for unexpected credential modifications.
• Implement additional authentication layers for administrative access.

Step-by-step guide: 7 Privilege Escalation Mistakes That Leave Systems Exposed

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this vulnerability?

The vulnerability is identified as CVE-2026-89079.

Which versions of Theme My Login are affected?

Versions up to and including 7.2.1 are vulnerable.

What is the CVSS score for this flaw?

The National Vulnerability Database rates it as 9.8, which is critical.