CVE-2026-89079
9.8CriticalPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-269
Impact
Unauthenticated remote attackers can take over arbitrary accounts by resetting their passwords on vulnerable multisite installations. They only need network access to the target WordPress site.
Root cause
The plugin fails to properly validate the user's identity before processing a password update request.
Affected systems
Theme My Login plugin for WordPress up to and including version 7.2.1
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Theme My Login to a version higher than 7.2.1. If you cannot patch immediately, disable the Theme My Login plugin.
$ wp plugin update theme-my-loginAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.