All vulnerabilities
CVE-2026-89079

Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter

jfarthing84 Theme My Login
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationScanner template publicA Nuclei template detects it. Not in the KEV catalogNuclei
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published16 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Public exploit code and templates 1

  • Scanner templateTheme My Login <= 7.2.1 - Privilege EscalationNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.

Text from CVE List

Affected versions 1

  • Theme My Loginaffected: all versions through 7.2.1CVE List

References 2