{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/theme-my-login--7.2.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:thememylogin:theme_my_login:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-89079"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Theme My Login (\u003c= 7.2.1)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","plugin","privilege-escalation","web-application"],"_cs_type":"advisory","_cs_vendors":["Theme My Login"],"content_html":"\u003cp\u003eThe Theme My Login plugin for WordPress, in versions up to and including 7.2.1, contains a critical security vulnerability (CVE-2026-89079) that enables account takeover. The flaw resides in the plugin's password update mechanism, which fails to adequately verify the identity of the user requesting the change. On multi-site WordPress installations with specific configurations, this weakness allows an unauthenticated attacker to supply target user identifiers and successfully reset their passwords without prior authentication. Given the nature of this vulnerability, it poses a high risk of privilege escalation, potentially granting attackers administrative access to the affected WordPress instances. Defenders should treat this as a high-priority update, as successful exploitation results in complete compromise of affected accounts.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-89079 allows unauthenticated remote attackers to gain unauthorized access to any user account on vulnerable multi-site WordPress installations. This can lead to the total compromise of site administration, unauthorized data access, and potential persistence if an attacker creates or promotes additional accounts. The scope is limited to WordPress installations utilizing the Theme My Login plugin in specific configurations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the Theme My Login plugin to the latest patched version available.\u003c/li\u003e\n\u003cli\u003eAudit WordPress user activity logs for suspicious password change events, specifically looking for password resets performed for administrative accounts by unknown or unauthenticated sessions.\u003c/li\u003e\n\u003cli\u003eReview all user accounts for unauthorized changes to security credentials.\u003c/li\u003e\n\u003cli\u003eDisable the affected plugin functionality on multi-site configurations until the software has been updated.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T08:24:49Z","date_published":"2026-10-16T08:24:49Z","id":"https://feed.craftedsignal.io/briefs/2026-10-theme-my-login-privilege-escalation/","summary":"An unauthenticated account takeover vulnerability in the Theme My Login WordPress plugin allows attackers to change arbitrary user passwords due to improper identity validation.","title":"Theme My Login Privilege Escalation via Account Takeover","url":"https://feed.craftedsignal.io/briefs/2026-10-theme-my-login-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Theme My Login (\u003c= 7.2.1)","version":"https://jsonfeed.org/version/1.1"}