---
id: "CVE-2026-89079"
kind: "vulnerability"
aliases: ["CVE-2026-89079"]
title: "The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["multisite", "package", "self-hosted", "theme-my-login", "wordpress"]
not_affected_if: ["plugin-not-installed", "single-site-default-config", "version-above-7.2.1"]
published_at: "2026-10-16T06:17:12+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-23T22:28:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89079", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up…

The Theme My Login WordPress plugin up to and including 7.2.1 does not verify a user's identity before changing their password. An unauthenticated attacker can reset arbitrary users' passwords, which leads to account takeover and privilege escalation, on multi-site setups in certain configurations.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether the Theme My Login plugin is installed and its version is 7.2.1 or lower, for example with wp plugin list --name=theme-my-login on the WP-CLI host.
Check whether the site runs WordPress multisite.

## Fix

Update Theme My Login to a version newer than 7.2.1; the patched version is not named in the sources.
If no patch is available, disable or remove the plugin.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89079

## From the sources

The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_