WordPress Plugin Vulnerabilities

Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation

Description

The plugin does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them.

Proof of Concept

Affects Plugins

Plugin icon
theme-my-login
Fixed in 7.2.0

References

CVE
CVE-2026-81583

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Jakub Herman
Submitter
Jakub Herman
Submitter website
https://jakubherman.net
Verified
Yes
WPVDB ID
6ced93ee-5629-42a4-9103-44cf99265bd2

Timeline

Publicly Published
2026-08-31 (about 2 days ago)
Added
2026-08-31 (about 1 day ago)
Last Updated
2026-08-31 (about 1 day ago)

Other

Published
Title
Published
2025-12-02
Title
DesignThemes LMS < 1.0.5 - Unauthenticated Privilege Escalation
Published
2026-08-11
Title
AcyMailing < 11.0.0 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update
Published
2026-07-15
Title
WPFunnels < 3.12.9 - Funnel Manager+ Privilege Escalation via 'group_id' Path Parameter
Published
2026-08-12
Title
Essential Addons for Elementor < 6.7.2 - Unauthenticated Privilege Escalation via Custom Profile Field Mass Assignment
Published
2025-03-06
Title
School Management System for Wordpress <= 93.0.0 - Student+ Account Takeover and Privilege Escalation