WordPress security changelog
MEDIUM CVE-2026-83628 Deferred

Theme My Login bypasses Multisite subsite-registration policy

Theme My Login through 7.1.15 does not enforce the Multisite network's active_signup policy in tml_ms_signup_handler() when a Subscriber posts stage=gimmeanotherblog to its signup route. The handler calls wpmu_create_blog() with the attacker's user ID, after which WordPress assigns that account Administrator on the new subsite. The attacker remains a Subscriber on the main site and does not gain Super Admin or network-management capabilities.

CVE / CNA score 4.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Theme My Login
Plugin slug
theme-my-login
Affected
<= 7.1.15
Safe version
7.2.0
Published
Sep 05, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published Sep 05, 2026 and is one of 6 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Theme My Login to 7.2.0 or later and review unexpected subsites and their administrators on affected Multisite networks.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the `tml_ms_signup_handler()` function's `gimmeanotherblog` branch failing to enforce the network's `active_signup` registration policy, checking only `is_user_logged_in()` while sibling branches such as `validate-blog-signup` apply the full policy gate. This makes it possible for authenticated attackers, with Subscriber-level access and above, to directly POST `stage=gimmeanotherblog` to Theme My Login's signup route, bypassing the configured registration policy entirely — even when it is set to `none` or `user` — which causes `wpmu_create_blog()` to execute with the attacker's user ID, after which WordPress core assigns the Administrator role on the newly created subsite via `add_user_to_blog()`. The privilege gain is scoped to the newly created subsite only; the attacker's account retains Subscriber-level access on the main site and does not obtain Super Admin or network-level capabilities such as `manage_network` or `manage_sites`.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Primary and upstream sources