Unauthenticated Attackers Can Take Over WordPress Accounts via Theme My Login Flaw

The National Vulnerability Database has rated a flaw in the popular WordPress plugin Theme My Login as critical, assigning it a CVSS score of 9.8. This vulnerability, tracked as CVE-2026-89079, allows unauthenticated attackers to escalate privileges by taking over user accounts. The issue stems from improper identity validation during password updates.

According to the NVD record, the weakness is classified under CWE-269, which covers improper privilege management. The flaw exists in all versions of the Theme My Login plugin up to and including version 7.2.1. Developers jfarthing84 are the creators of the affected software. The vulnerability enables attackers to change the passwords of arbitrary users without needing to authenticate first.

Context and Background

This incident highlights persistent security challenges in third-party WordPress extensions. As Threat Times reported on 2026-10-15, other plugins have recently faced similar scrutiny. For instance, a critical privilege escalation flaw was found in the DynamiApps Frontend Admin plugin, which also allowed attackers to gain higher-level access on vulnerable sites. Additionally, OPNsense addressed a critical flaw in its GeoIP importer process that allowed command execution as root.

The Theme My Login vulnerability is distinct because it requires no initial authentication. An attacker does not need to compromise a low-privilege account first. Instead, they can directly target the password update mechanism. This bypasses standard security controls that rely on verified user sessions. The lack of proper identity validation before updating credentials creates a direct path to account takeover.

Who Is Affected

The vulnerability primarily impacts WordPress installations using the Theme My Login plugin in versions 7.2.1 or earlier. According to the NVD description, the flaw is exploitable on multi-site setups in certain configurations. Single-site installations may not be vulnerable depending on their specific setup, but multi-site networks are at significant risk. Any user account on the affected network can be targeted, including administrators.

Administrators of WordPress multi-site networks should immediately verify their plugin versions. If the site uses Theme My Login version 7.2.1 or any prior release, it is potentially vulnerable. The ability to change arbitrary user passwords means an attacker could gain full administrative control if they target an admin account. This could lead to complete compromise of the website and its data.

What should you do?

No patch or update has been confirmed yet according to the provided source material. Administrators should monitor official channels from the plugin developer for a security release. In the interim, consider restricting access to the plugin's functionality if possible. Review server logs for suspicious password change attempts. Ensure that other security measures, such as two-factor authentication, are enabled to mitigate potential account takeover.