Theme My Login Privilege Escalation via Account Takeover

The Theme My Login plugin for WordPress, in versions up to and including 7.2.1, contains a critical security vulnerability (CVE-2026-89079) that enables account takeover. The flaw resides in the plugin's password update mechanism, which fails to adequately verify the identity of the user requesting the change. On multi-site WordPress installations with specific configurations, this weakness allows an unauthenticated attacker to supply target user identifiers and successfully reset their passwords without prior authentication. Given the nature of this vulnerability, it poses a high risk of privilege escalation, potentially granting attackers administrative access to the affected WordPress instances. Defenders should treat this as a high-priority update, as successful exploitation results in complete compromise of affected accounts.

Impact

Successful exploitation of CVE-2026-89079 allows unauthenticated remote attackers to gain unauthorized access to any user account on vulnerable multi-site WordPress installations. This can lead to the total compromise of site administration, unauthorized data access, and potential persistence if an attacker creates or promotes additional accounts. The scope is limited to WordPress installations utilizing the Theme My Login plugin in specific configurations.

Recommendation

• Immediately update the Theme My Login plugin to the latest patched version available.
• Audit WordPress user activity logs for suspicious password change events, specifically looking for password resets performed for administrative accounts by unknown or unauthenticated sessions.
• Review all user accounts for unauthorized changes to security credentials.
• Disable the affected plugin functionality on multi-site configurations until the software has been updated.