EUVD-2026-69857
GHSA-rx7v-j56c-vf8f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Scope change applies as subscriber crosses privilege boundary to site-admin; integrity is H (full site control), not L; A:L in provided vector is unsupported by description.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them.
AnalysisAI
Privilege escalation in the Theme My Login WordPress plugin (versions before 7.2.0) allows low-privileged users to silently bypass the network's site-creation restrictions on multisite WordPress installations, gaining administrator-level control over a newly created site. Subscriber-level authenticated users - and on some networks, unauthenticated users - can invoke the site-signup flow to create sites even when the network's registration setting prohibits it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires WordPress to be running in multisite mode with the Theme My Login plugin (versions before 7.2.0) active on the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-provided CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) understates real-world impact: gaining site administrator over a WordPress site confers the ability to install arbitrary plugins, modify themes, and access all data within that site, which is better characterized as I:H rather than I:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Theme My Login to version 7.2.0 or later, which enforces the network registration setting during multisite site signups. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Theme My Login
View allTheme My Login plugin for WordPress (≤7.1.15) on Multisite installations allows authenticated Subscriber-level accounts
Cross-Site Request Forgery in the Theme My Login WordPress plugin (versions ≤7.1.14) enables unauthenticated attackers t
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today