Theme My Login CVE-2026-89079

Exploitation requires the target to run WordPress in multisite (network) mode with Theme My Login <= 7.2.1 installed in a specific configuration that exposes the unvalidated password-update code path; the description explicitly limits impact to 'multi-site setups in certain configurations,' so standard single-site installations are not stated to be affected. No authentication or user interaction is required once the vulnerable configuration is present (PR:N/UI:N), but the non-default multisite requirement is the primary limiting factor that reduces the realistic attack surface well below what the 9.8 base score implies.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates this as a critical, trivially-exploitable remote unauthenticated flaw, but this conflicts with the description, which explicitly scopes exploitation to 'multi-site setups in certain configurations.' That caveat means the AC:L (low complexity) and unconditional network reach implied by the 9.8 score overstate real-world exposure - the flaw is not universally exploitable against a default single-site WordPress install, so the effective attack complexity is higher than the vector claims. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' Net assessment: a genuinely serious privilege-escalation/account-takeover bug (full admin compromise is possible via password reset) that warrants prompt patching on affected WordPress multisite deployments, but the 9.8 headline likely overstates the practical threat because the vulnerable code path depends on a non-default multisite configuration. Verify the exact triggering configuration with Wordfence before deprioritizing.

On a vulnerable WordPress multisite network running Theme My Login <= 7.2.1 in a susceptible configuration, a remote unauthenticated attacker submits a crafted password-update request that the plugin processes without properly validating the requester's identity. The attacker sets a new password for an arbitrary target account - including a network or site administrator - and then logs in to take full control. No public exploit code was identified at the time of analysis.