Theme My Login: Unauthenticated account takeover via password reset
Summary
The Theme My Login WordPress plugin up to and including 7.2.1 does not properly verify a user's identity before updating their password. Under certain configurations on WordPress Multisite, an unauthenticated attacker can change the password of arbitrary users, including administrators. A successful attack gives full control over the affected site or network. A public proof of concept is reported, and the fix has been available since 7.2.2.
Affected
- Theme My Login up to and including 7.2.1
- Relevant mainly on WordPress Multisite in certain configurations (the option tml_user_passwords is reported to be required)
Fixed in
- Version 7.2.2 or later (released 2026-09-11, before the CVE publication date)
Workaround
- No vendor workaround known.
- If patching is not possible: restrict access to login and password-reset endpoints (IP allowlist or WAF rules). This reduces exposure but does not fix the flaw.
- Review logs for password-reset requests targeting administrator accounts.
Exploitation
- Public proof of concept: reported (GitHub, PoC write-up). Not reviewed or reproduced here.
- A Nuclei detection template exists, so scanners can check for this issue.
- Listed as exploited in VulnCheck KEV on a mirror, but not confirmed by the vendor or other sources. No CISA KEV listing found.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
Our recommendation
- Inventory all WordPress sites and networks running Theme My Login and check the version and whether Multisite is used.
- Update to 7.2.2 or later, starting with Multisite networks, and verify the version shown in WordPress.
- If patching is delayed, restrict login and password-reset endpoints and review logs.
- After patching, check for unexpected password changes and new or changed administrator accounts, and reset administrator passwords if anything looks wrong.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
murrez/CVE-2026-89079
Research sources
- Wordfence threat intelligence entry www.wordfence.com
- WordPress.org changeset 3696081 (fix) plugins.trac.wordpress.org
- Theme My Login GitHub releases github.com
- VulDB CVE-2026-89079 vuldb.com
- VulDB entry 421140 vuldb.com
- Vulners Nuclei template CVE-2026-89079 vulners.com
- PoC write-up (pocbit) pocbit.org
- Strix CVE-2026-89079 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:42.
Original description (NVD)
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.