Critical severity · published Oct 16, 2026
CVE-2026-89079
Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
9.8
CVSS
1.6%
EPSS
No
On KEV
Description
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TM
Theme My Login · jfarthing84
through 7.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-89079
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-89079
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3696081/theme-my-login
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/53c548be-b8aa-4949-93f8-7b4d73688540?source=cve
More from Theme My Login
4.3
CVE-2026-83628
Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage
4.3
CVE-2024-7422
Theme My Login <= 7.1.7 - Cross-Site Request Forgery to Settings Update