Theme My Login CVE-2026-66681

The victim must be an authenticated WordPress user (any role capable of triggering the targeted plugin action) with an active session cookie, and must visit or interact with an attacker-controlled page that hosts the forged request. The CVSS UI:R metric confirms this victim-interaction requirement is mandatory - the attack cannot be triggered passively or without social engineering. The plugin must be installed and active on the target WordPress site running a version at or below 7.1.14. No server-side non-default configuration is required beyond plugin activation. Exploitation is limited by: (1) the need to identify and target a specific authenticated user, (2) the social-engineering step required to deliver the malicious page, and (3) the impact being constrained to integrity (I:L) - no credential theft or remote code execution is directly achievable via this vector alone.

The CVSS 3.1 base score of 4.3 (Medium) reflects the constrained impact: Integrity is only Low (I:L), with no Confidentiality or Availability impact (C:N/A:N), and exploitation requires victim interaction (UI:R). The network attack vector (AV:N) and low complexity (AC:L) mean an attacker can craft a payload with no specialized skill, but they must induce a logged-in WordPress user to visit a malicious page - a real but non-trivial barrier. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. No KEV listing is present, and no POC or exploit code is referenced in the advisory, suggesting opportunistic exploitation is not currently widespread. The primary real-world risk is targeted attacks against specific WordPress site administrators or editors, where forged requests could alter login-flow settings, user roles, or account configurations managed by the plugin. This is not a panic-tier vulnerability, but it is a meaningful exposure for sites where the plugin is active.

An attacker hosts a webpage containing a hidden HTML form whose action points to a Theme My Login plugin endpoint (e.g., a user-settings or role-assignment action). When an authenticated WordPress administrator visits the page - via a phishing email, malicious ad, or injected link - the victim's browser automatically submits the forged request with the administrator's session cookies, causing the plugin to execute the unauthorized action. No public exploit identified at time of analysis, but the technique requires no specialized tools beyond basic HTML knowledge.