Theme My Login
Monthly
Privilege escalation in the Theme My Login plugin for WordPress (versions up to and including 7.2.1) allows unauthenticated attackers to change arbitrary user passwords on multisite installations in certain configurations, leading to account takeover and potential full network compromise. The flaw stems from improper validation of user identity before password updates (CWE-269). Exploitation requires a non-default multisite setup, and no public exploit code is identified at time of analysis; the effective attack complexity is higher than the base CVSS 9.8 score implies due to this configuration dependency.
Theme My Login plugin for WordPress (≤7.1.15) on Multisite installations allows authenticated Subscriber-level accounts to bypass the network's `active_signup` registration policy by posting directly to the `gimmeanotherblog` handler, which omits the policy gate enforced by sibling branches and unconditionally invokes `wpmu_create_blog()` with the attacker's user ID. WordPress core then assigns the Administrator role on the resulting subsite, granting full subsite control - including plugin and theme installation - to an otherwise low-privileged user. No public exploit code or CISA KEV listing has been identified; Wordfence reported the issue and a fix is confirmed in version 7.2.0.
Privilege escalation in the Theme My Login WordPress plugin (versions before 7.2.0) allows low-privileged users to silently bypass the network's site-creation restrictions on multisite WordPress installations, gaining administrator-level control over a newly created site. Subscriber-level authenticated users - and on some networks, unauthenticated users - can invoke the site-signup flow to create sites even when the network's registration setting prohibits it. A publicly available proof-of-concept exploit exists, raising the urgency for patching. The vendor has released a fix in version 7.2.0.
Cross-Site Request Forgery in the Theme My Login WordPress plugin (versions ≤7.1.14) enables unauthenticated attackers to trigger unauthorized state-changing actions on behalf of authenticated victims. The CVSS vector (PR:N/UI:R/I:L) confirms no attacker authentication is needed, though a victim must be lured to a malicious page - limiting mass exploitation but still representing a realistic social-engineering attack path for sites using this plugin to customize their authentication flows. No public exploit identified at time of analysis, and no CISA KEV listing is present.
Privilege escalation in the Theme My Login plugin for WordPress (versions up to and including 7.2.1) allows unauthenticated attackers to change arbitrary user passwords on multisite installations in certain configurations, leading to account takeover and potential full network compromise. The flaw stems from improper validation of user identity before password updates (CWE-269). Exploitation requires a non-default multisite setup, and no public exploit code is identified at time of analysis; the effective attack complexity is higher than the base CVSS 9.8 score implies due to this configuration dependency.
Theme My Login plugin for WordPress (≤7.1.15) on Multisite installations allows authenticated Subscriber-level accounts to bypass the network's `active_signup` registration policy by posting directly to the `gimmeanotherblog` handler, which omits the policy gate enforced by sibling branches and unconditionally invokes `wpmu_create_blog()` with the attacker's user ID. WordPress core then assigns the Administrator role on the resulting subsite, granting full subsite control - including plugin and theme installation - to an otherwise low-privileged user. No public exploit code or CISA KEV listing has been identified; Wordfence reported the issue and a fix is confirmed in version 7.2.0.
Privilege escalation in the Theme My Login WordPress plugin (versions before 7.2.0) allows low-privileged users to silently bypass the network's site-creation restrictions on multisite WordPress installations, gaining administrator-level control over a newly created site. Subscriber-level authenticated users - and on some networks, unauthenticated users - can invoke the site-signup flow to create sites even when the network's registration setting prohibits it. A publicly available proof-of-concept exploit exists, raising the urgency for patching. The vendor has released a fix in version 7.2.0.
Cross-Site Request Forgery in the Theme My Login WordPress plugin (versions ≤7.1.14) enables unauthenticated attackers to trigger unauthorized state-changing actions on behalf of authenticated victims. The CVSS vector (PR:N/UI:R/I:L) confirms no attacker authentication is needed, though a victim must be lured to a malicious page - limiting mass exploitation but still representing a realistic social-engineering attack path for sites using this plugin to customize their authentication flows. No public exploit identified at time of analysis, and no CISA KEV listing is present.