{"id":"CVE-2026-89079","kind":"vulnerability","aliases":["CVE-2026-89079"],"related":[],"title":"The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up…","description":"The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.","summary":"The Theme My Login WordPress plugin up to and including 7.2.1 does not verify a user's identity before changing their password. An unauthenticated attacker can reset arbitrary users' passwords, which leads to account takeover and privilege escalation, on multi-site setups in certain configurations.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multisite","package","self-hosted","theme-my-login","wordpress"],"not_affected_if":["plugin-not-installed","single-site-default-config","version-above-7.2.1"],"how_to_check":"Check whether the Theme My Login plugin is installed and its version is 7.2.1 or lower, for example with wp plugin list --name=theme-my-login on the WP-CLI host.\nCheck whether the site runs WordPress multisite.","fix":"Update Theme My Login to a version newer than 7.2.1; the patched version is not named in the sources.\nIf no patch is available, disable or remove the plugin.","status":"open","published_at":"2026-10-16T06:17:12+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-23T22:05:09+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T22:05:09Z","model":"claude-haiku-5-5","output":{"fix":"Update Theme My Login to a version newer than 7.2.1; the patched version is not named in the sources.\nIf no patch is available, disable or remove the plugin.","reach":"internet","impact":"high","summary":"The Theme My Login WordPress plugin up to and including 7.2.1 does not verify a user's identity before changing their password. An unauthenticated attacker can reset arbitrary users' passwords, which leads to account takeover and privilege escalation, on multi-site setups in certain configurations.","category":"package","who_cares":["wordpress","theme-my-login","multisite","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker takes over any user account, including administrators.","analyst_note":"Confirm the fixed plugin version and the exact multisite configuration that is vulnerable, using the NVD entry and the plugin's changelog.","how_to_check":"Check whether the Theme My Login plugin is installed and its version is 7.2.1 or lower, for example with wp plugin list --name=theme-my-login on the WP-CLI host.\nCheck whether the site runs WordPress multisite.\nunknown","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-7.2.1","single-site-default-config"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.00052,"input_tokens":2780,"output_tokens":484,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':19A,22A '-89079':20A,23A '7.2.1':44B,101C 'account':14A,67B,93C 'arbitrari':61B,129C 'attack':58B,126C 'certain':78B,139C 'chang':53B,128C 'configur':79B,140C 'cve':18A,21A 'due':104C 'escal':12A,71B,91C 'host':28B 'ident':51B,114C 'includ':43B,100C 'lead':65B 'login':4A,32B,37B,83C 'make':121C 'multi':74B,135C 'multi-sit':73B,134C 'multisit':24B 'packag':25B 'password':55B,63B,119C,132C 'plugin':5A,39B,84C,107C 'possibl':123C 'prior':115C 'privileg':11A,70B,90C 'proper':109C 'reset':60B 'self':27B 'self-host':26B 'setup':76B,137C 'site':75B,136C 'takeov':15A,68B,94C 'theme':2A,30B,35B,81C 'theme-my-login':29B 'unauthent':57B,125C 'updat':117C 'user':49B,62B,112C,130C 'valid':110C 'verifi':47B 'version':17A,96C 'via':13A,92C 'vulner':9A,88C 'wordpress':7A,33B,38B,86C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T06:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-89079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89079","severity":null,"published_at":"2026-10-16T06:17:12+00:00","modified_at":"2026-10-16T18:19:42+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}