Description

Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-06T15:17:21.473Z",
  "pubdate": "2026-08-06T15:17:21.473Z",
  "executiveSummary": "An unauthenticated Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Theme My Login plugin affecting versions 7.1.14 and prior. This security flaw permits unauthenticated malicious actors to induce authenticated users into executing unintended actions on the affected WordPress application without their consent or knowledge. The risk implications associated with this vulnerability include the potential compromise of user account integrity, unauthorized state changes, and potential privilege escalation depending on the privileges of the targeted user interacting with the forged request. Exploitation requires the targeted user to be authenticated and interacting with a malicious context, typically through browsing a web page controlled by the attacker that automatically submits requests to the vulnerable application. No authentication is required for the attacker to craft and deploy the exploit payload, although the attack relies entirely on social engineering or malicious redirection to force the victim's browser to execute the unauthorized HTTP requests against the target application endpoints.",
  "technicalDetails": "The vulnerability stems from the absence of robust anti-CSRF tokens, such as cryptographic nonces, within critical state-changing request handlers implemented by the Theme My Login plugin in versions 7.1.14 and below. Cross-Site Request Forgery occurs when a web application fails to validate whether a legitimate user explicitly intended to submit a specific request, allowing external sites to leverage the victim's existing session credentials.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious HTML payload, hosted on an external domain, designed to automatically issue HTTP requests to the targeted WordPress site running the vulnerable Theme My Login plugin. This payload typically utilizes automated form submissions, hidden image tags, or JavaScript fetch interfaces targeting sensitive application functions managed by the plugin. Second, the attacker induces a legitimate, authenticated user of the vulnerable WordPress site to visit the malicious domain or view compromised content. Third, the victim's web browser automatically includes all associated session cookies and authentication credentials in the cross-origin request directed at the target application. Fourth, because the vulnerable component lacks proper request validation and nonce verification mechanisms, the application processes the incoming request as a legitimate action authorized by the victim. Consequently, the server executes the state-changing operations intended by the attacker.\nThe vulnerable component resides within the core request processing functionality of the Theme My Login plugin for versions <= 7.1.14. Network exposure is external, as the attack vectors originate from the public internet via standard HTTP/HTTPS protocols. Privilege requirements for the attacker are non-existent (unauthenticated), while the privilege requirements for the victim depend on the specific functionality being targeted, ranging from standard subscribers to administrative users. The post-exploitation impact includes unauthorized modification of user account settings, potential creation of unauthorized administrative accounts, or execution of other privileged actions exposed by the plugin's endpoints."
}