Description

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the `tml_ms_signup_handler()` function's `gimmeanotherblog` branch failing to enforce the network's `active_signup` registration policy, checking only `is_user_logged_in()` while sibling branches such as `validate-blog-signup` apply the full policy gate. This makes it possible for authenticated attackers, with Subscriber-level access and above, to directly POST `stage=gimmeanotherblog` to Theme My Login's signup route, bypassing the configured registration policy entirely — even when it is set to `none` or `user` — which causes `wpmu_create_blog()` to execute with the attacker's user ID, after which WordPress core assigns the Administrator role on the newly created subsite via `add_user_to_blog()`. The privilege gain is scoped to the newly created subsite only; the attacker's account retains Subscriber-level access on the main site and does not obtain Super Admin or network-level capabilities such as `manage_network` or `manage_sites`.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-05T06:17:10.230Z",
  "pubdate": "2026-09-05T06:17:10.230Z",
  "executiveSummary": "Theme My Login versions up to and including 7.1.15 contain a Missing Authorization vulnerability within its WordPress Multisite registration handling logic.\nThe vulnerability resides in the tml_ms_signup_handler() function, specifically the gimmeanotherblog branch, which fails to validate the network's active_signup registration policy.\nAn authenticated attacker with Subscriber-level access or higher can bypass global registration restrictions by sending a crafted POST request to the plugin's signup route.\nSuccessful exploitation forces the execution of wpmu_create_blog() using the attacker's user ID, resulting in the creation of a new subsite where the attacker is automatically granted Administrator privileges.\nWhile the impact is confined to the newly created subsite and does not grant global network-level or Super Admin permissions, it represents a significant security breach by allowing unauthorized site creation and localized administrative control.\nThis flaw underscores a failure in policy enforcement, as the plugin relies on a superficial session check instead of the standard WordPress Multisite registration gate.",
  "technicalDetails": "The vulnerability is rooted in an inconsistent authorization check within the Theme My Login plugin's Multisite integration, specifically within the tml_ms_signup_handler() function.\nIn a WordPress Multisite environment, registration policies are governed by the active_signup network setting. While other logic branches, such as validate-blog-signup, correctly invoke the required policy gates to verify if registrations are enabled, the gimmeanotherblog branch fails to perform this verification.\nInstead of checking against the network policy, the code relies solely on is_user_logged_in(), which is insufficient for verifying if a user possesses the necessary permissions to provision a new site.\nAn attacker can exploit this by sending a POST request to the Theme My Login signup route with the parameter stage set to 'gimmeanotherblog'. Because the function lacks the necessary registration gate, it proceeds to call wpmu_create_blog(), passing the attacker's current user ID.\nUpon execution, the WordPress core function wpmu_create_blog() instantiates the new subsite and subsequently triggers add_user_to_blog(), which assigns the Administrator role to the caller on that specific site.\nThis creates an elevation of privilege scenario where a low-privileged authenticated user (e.g., a standard Subscriber) can effectively create an arbitrary site on the network and attain full administrative control over that instance.\nThe exploit bypasses both 'none' and 'user' registration policies configured in the Network Admin panel, effectively rendering the site creation restriction mechanism null for authenticated users.\nThe scope of this vulnerability is limited to the newly created subsite; the attacker does not gain privileges on the main network site or any existing sites, nor do they obtain Super Admin status, which requires the manage_network capability.\nHowever, the ability to create rogue subsites on a network can be leveraged for malicious purposes, such as hosting phishing pages, distributing malware, or abusing server resources, despite the scope limitation."
}