What is the CVSS score of EUVD-2026-53893?

EUVD-2026-53893 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Theme My Login EUVD-2026-53893

| CVE-2026-66681 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-08-06 Patchstack

GHSA-vgf8-cc6h-j39j

WordPress CSRF Wordpress Plugin Theme My Login

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network vector with no attacker privileges required; victim interaction mandatory (UI:R); impact limited to low integrity - no confidentiality or availability loss applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:13 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.

AnalysisAI

Cross-Site Request Forgery in the Theme My Login WordPress plugin (versions ≤7.1.14) enables unauthenticated attackers to trigger unauthorized state-changing actions on behalf of authenticated victims. The CVSS vector (PR:N/UI:R/I:L) confirms no attacker authentication is needed, though a victim must be lured to a malicious page - limiting mass exploitation but still representing a realistic social-engineering attack path for sites using this plugin to customize their authentication flows. No public exploit identified at time of analysis, and no CISA KEV listing is present.

Technical ContextAI

Theme My Login (CPE: cpe:2.3:a:jeff_farthing:theme_my_login) is a WordPress plugin authored by Jeff Farthing that replaces WordPress's default login, registration, and lost-password pages with themed equivalents - making it a sensitive component in the authentication surface of any WordPress installation that uses it. The root cause is CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to validate that state-changing HTTP requests originate from the legitimate WordPress dashboard context. WordPress provides nonce-based CSRF protection that plugins must explicitly implement; the absence or bypass of nonce checks on one or more plugin endpoints allows a forged request submitted by a victim's authenticated browser to be accepted as legitimate by the server.

RemediationAI

Upgrade Theme My Login to a version beyond 7.1.14 as soon as a patched release is available from the plugin's WordPress.org listing or the developer's repository; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/theme-my-login/vulnerability/wordpress-theme-my-login-plugin-7-1-14-cross-site-request-forgery-csrf-vulnerability should be monitored for the confirmed fix version, which was not independently confirmed in the available input data. If an upgrade is not immediately possible, deactivating the plugin eliminates the attack surface entirely - the trade-off is loss of the customized login/registration experience. A compensating control via a Web Application Firewall rule that blocks cross-origin form submissions to the plugin's endpoints can reduce exposure, though this may interfere with legitimate cross-subdomain authentication flows. WordPress site administrators should also enforce Content Security Policy headers and ensure that authentication actions require re-verification to limit the blast radius of any successful CSRF.