{"id":"CVE-2026-89079","published":"2026-10-16T06:17:12.410","lastModified":"2026-10-16T18:19:42.210","description":"The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3696081/theme-my-login","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/53c548be-b8aa-4949-93f8-7b4d73688540?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Theme My Login plugin allows unauthenticated attackers to change any user's password on multi-site WordPress setups due to insufficient user identity validation during password updates. This creates a critical privilege escalation vulnerability that can lead to full account takeover.","exploitability":"Exploitation is straightforward with no prerequisites, requiring only access to the plugin's password reset endpoint on affected multi-site installations.","blast_radius":"The impact could be severe across multiple user accounts and sites within a multi-site WordPress network, potentially allowing attackers to gain persistent access to administrator accounts and compromise entire networks.","remediation":"Upgrade to version 7.2.2 or later which contains the fix for this privilege escalation vulnerability.","detection":"Monitor for unusual password reset requests in WordPress logs, particularly those occurring without prior authentication attempts, and watch for failed login attempts followed immediately by successful password changes.","tags":["privilege-escalation","wordpress","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:47:19.625Z"}}