Live › vulnerability › CVE-2026-89079
Go to dashboardThe Theme My Login WordPress plugin up to and including 7.2.1 does not verify a user's identity before changing their password. An unauthenticated attacker can reset arbitrary users' passwords, which leads to account takeover and privilege escalation, on multi-site setups in certain configurations.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
7.2.1 or lower, for example with wp plugin list --name=theme-my-login on the WP-CLI host7.2.1; the patched version is not named in the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.
This page as .md · .json · in your agent: get_signal("CVE-2026-89079")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.