CVE-2026-89079
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover…
- Risk score
- 76/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 1.0%
- Published
- 16 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.
Last activity 16 Oct 2026. Patch Forecast updates every hour.