Description

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T06:17:19.570Z",
  "pubdate": "2026-09-02T06:17:19.570Z",
  "executiveSummary": "The My Login WordPress plugin before version 7.2.0 contains an improper access control vulnerability within its multisite installation site signup process. The plugin fails to validate global network registration settings, allowing unauthorized site creation. This oversight enables low-privileged users (subscribers) and, in specific multisite network configurations, unauthenticated actors to bypass registration restrictions. Successful exploitation grants the attacker administrator privileges over the newly created site. The vulnerability poses a significant risk to the integrity and security of the WordPress multisite network, as unauthorized site creation can lead to complete site takeover, malicious content distribution, or platform-wide abuse. Given the potential for privilege escalation and administrative control, this flaw represents a critical security gap for any multisite environment utilizing this plugin.",
  "technicalDetails": "The root cause of this vulnerability lies in the plugin's failure to programmatically respect the 'Registration' settings defined at the WordPress multisite network level. In a standard multisite environment, site registration is governed by the 'Registration' options in the Network Settings, which dictate whether new sites can be registered and by whom. The My Login plugin improperly intercepts or processes site signups without validating these constraints, effectively creating a logic flaw in the authentication and authorization flow.\nThe attack flow begins when an attacker identifies the signup endpoint or functional component facilitated by the My Login plugin. Because the plugin does not verify the network-wide 'Allow new registrations' setting, it treats the request as legitimate regardless of the current network state. For networks configured to allow only existing users to register sites, an attacker with a subscriber account can abuse the plugin to provision a new site. In configurations where site registration is open to all, unauthenticated users can bypass the intended restrictions entirely.\nDuring the exploitation process, the plugin initializes the site creation sequence without enforcing the expected security checks (e.g., checking if 'registration' is enabled for 'users' or 'none'). Once the site creation process completes, the plugin erroneously assigns the initiating user the 'administrator' role for the newly provisioned site. Because the site is created within the network, the attacker gains full control over the specific site's theme, plugins, and content management, essentially escalating their privileges from a subscriber or anonymous entity to a full site administrator.\nThe vulnerability affects all versions of the My Login plugin prior to 7.2.0. The lack of proper integration with WordPress Core's multisite registration hooks allows the bypass to persist. Post-exploitation impact is severe, as the attacker can leverage the compromised site to host phishing pages, deploy malicious scripts, or exfiltrate sensitive data, potentially utilizing the site's legitimate reputation within the network to facilitate further attacks or bypass security filters. This architectural failure demonstrates an inadequate implementation of authorization checks in the context of WordPress multisite's hierarchical permission model."
}