Theme My Login CVE-2026-81583

Exploitation requires WordPress to be running in multisite mode with the Theme My Login plugin (versions before 7.2.0) active on the network. For the primary attack path, the attacker must hold a subscriber-level account on the multisite network (PR:L per CVSS). On some networks where registration is open, the description explicitly notes that unauthenticated users may also be able to exploit this, making the authentication requirement network-configuration-dependent. Limits to exploitation: single-site WordPress installations are not affected; the attacker does not gain network-admin (superadmin) rights, only site-admin rights over the newly created site; and exploitation is limited to networks where the Theme My Login plugin is installed and active.

The vendor-provided CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) understates real-world impact: gaining site administrator over a WordPress site confers the ability to install arbitrary plugins, modify themes, and access all data within that site, which is better characterized as I:H rather than I:L. A:L in the provided vector is unexplained by the description and appears inflated - no availability mechanism is apparent. Scope is unchanged (S:U) at the network level since the attacker does not gain superadmin/network-admin rights, but within the new site, the compromise is effectively total. The publicly available PoC (WPScan) significantly lowers the exploitation bar. EPSS data is not present in the input, so probability of mass exploitation is unknown; however, the ease of exploitation (AC:L, PR:L) and existing PoC together suggest meaningful real-world risk for any multisite network running the unpatched plugin. No CISA KEV listing is indicated, so exploitation is not confirmed as active at time of analysis.

An attacker with a subscriber account on a WordPress multisite network (e.g., a free-tier user who registered before registration was disabled by the network admin) calls the Theme My Login multisite site-signup endpoint with a chosen subdomain. The plugin processes the signup without checking the network's registration policy, creates the site, and grants the attacker administrator access to it. From that admin panel the attacker can install plugins with arbitrary PHP code, escalating to full RCE on the hosting server if file-system permissions allow. A public PoC is available via WPScan, making this accessible to non-expert attackers.