Description

The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-16T06:17:12.410Z",
  "pubdate": "2026-10-16T06:17:12.410Z",
  "executiveSummary": "The Theme My Login plugin for WordPress, in versions up to and including 7.2.1, contains a critical vulnerability involving improper identity validation during password modification processes. This security flaw enables unauthenticated attackers to perform account takeovers by changing the passwords of arbitrary users within specifically configured WordPress multi-site environments.\nThe vulnerability is classified as a privilege escalation flaw, stemming from the application's failure to verify the authenticity of a requestor before executing sensitive password reset or update operations. This failure allows malicious actors to bypass standard authentication mechanisms, granting them unauthorized control over targeted user accounts. The potential impact is significant, as it can lead to full administrative account compromise depending on the targeted user's role. Given that this exploit functions without prior authentication and specifically targets the account management workflow, it represents a high-risk security exposure for affected multi-site deployments. Remediation requires an immediate update to a version where these identity checks are strictly enforced.",
  "technicalDetails": "The root cause of the vulnerability in Theme My Login versions 7.2.1 and below is an insufficient validation mechanism during the password change routine. The plugin fails to verify the session or the identity of the user initiating the request before updating password credentials in the database. Consequently, the password change function is exposed to unauthorized calls, permitting an attacker to supply target identifiers and new credential strings, which the plugin processes as legitimate requests.\nIn a standard WordPress multi-site configuration, the plugin's architectural implementation allows for requests to be routed in a manner that circumvents the intended security barriers. The attack flow begins when an unauthenticated attacker crafts a malicious HTTP request targeting the password update endpoint. Because the underlying code does not enforce a requirement for a current password, a secure token, or an authenticated session cookie, the function proceeds to perform a direct SQL update or user object modification based solely on the provided input parameters.\nThe lack of robust server-side validation means that the attacker can manipulate user account settings remotely. By submitting a payload that specifies a target user ID and a new password, the attacker forces the system to overwrite the existing credentials of any user on the network. This exploit effectively renders the account's existing authentication data obsolete, allowing the attacker to assume control of the account immediately post-exploitation.\nThe vulnerability is particularly dangerous in multi-site environments because it potentially grants the attacker administrative privileges if an administrator's account is targeted. The lack of network segmentation or restrictive access control lists (ACLs) within the plugin's vulnerable component means that the attack can be executed over the public network, provided the site is reachable. The payload behavior is straightforward: the plugin accepts the request, verifies the availability of the target account, and commits the credential change without validating the requester's authority. Following successful exploitation, the legitimate account owner is locked out, and the attacker gains full access to the account's resources, sensitive data, and associated permissions, significantly compromising the integrity and security of the WordPress multi-site installation."
}