Theme My Login
Monthly
Cross-Site Request Forgery in the Theme My Login WordPress plugin (versions ≤7.1.14) enables unauthenticated attackers to trigger unauthorized state-changing actions on behalf of authenticated victims. The CVSS vector (PR:N/UI:R/I:L) confirms no attacker authentication is needed, though a victim must be lured to a malicious page - limiting mass exploitation but still representing a realistic social-engineering attack path for sites using this plugin to customize their authentication flows. No public exploit identified at time of analysis, and no CISA KEV listing is present.
Cross-Site Request Forgery in the Theme My Login WordPress plugin (versions ≤7.1.14) enables unauthenticated attackers to trigger unauthorized state-changing actions on behalf of authenticated victims. The CVSS vector (PR:N/UI:R/I:L) confirms no attacker authentication is needed, though a victim must be lured to a malicious page - limiting mass exploitation but still representing a realistic social-engineering attack path for sites using this plugin to customize their authentication flows. No public exploit identified at time of analysis, and no CISA KEV listing is present.