Theme My Login CVE-2026-83628

Exploitation requires an authenticated session with at least Subscriber-level access on the main site of a WordPress Multisite network running Theme My Login 7.1.15 or earlier. WordPress Multisite itself must be enabled - this is not a default configuration and requires deliberate server setup. The vulnerability is most impactful when active_signup is set to none or user, since these are the policies the missing authorization gate is intended to enforce; on networks where active_signup is all (open blog creation for all authenticated users), the flaw adds little marginal risk beyond what the policy already permits. Unauthenticated exploitation is not possible: a valid WordPress user account on the target network is a hard prerequisite, confirmed by PR:L in the CVSS vector. The resulting privilege gain is strictly scoped to the attacker-created subsite - the attacker does not gain Super Admin, manage_network, or manage_sites capabilities, and their account retains Subscriber-level access on the main site.

The provided CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately captures the constrained blast radius: the attacker must already hold a Subscriber account, and the resulting Administrator role is scoped to a newly created subsite only - not the main site, not Super Admin, and not network-level capabilities like manage_network or manage_sites. However, I:L understates a secondary risk: a subsite Administrator can install plugins and themes, which on servers with writable filesystems could translate to remote code execution, turning a subsite foothold into full-server compromise. This chained risk is not reflected in the CVSS score and should inform remediation urgency on networks with permissive file permissions. No EPSS data was supplied, and there is no CISA KEV listing and no identified public exploit code at time of analysis, making this a medium-priority patch item rather than an emergency response. Even a mid-sized municipal IT team in bytom managing a WordPress Multisite network with active_signup set to none - a deliberate lockdown posture - should recognize this as a meaningful insider-threat vector, since the flaw directly defeats that specific control. The real-world risk is highest on Multisite networks where low-trust or externally registered accounts hold Subscriber access and where subsite plugin installation is not separately restricted.

An attacker who holds - or creates - a Subscriber-level account on a WordPress Multisite network running Theme My Login ≤7.1.15 sends a crafted POST request with stage=gimmeanotherblog to the plugin's signup route, bypassing the network's active_signup policy regardless of how it is configured. The plugin's incomplete authorization check allows wpmu_create_blog() to execute under the attacker's user ID, and WordPress core immediately grants them the Administrator role on the newly created subsite. From this foothold, the attacker can install arbitrary plugins or themes on the subsite, potentially achieving remote code execution on the underlying server if the WordPress filesystem is writable. No public exploit code has been identified, but the attack path is straightforward to reconstruct from the published source code and description.