CVE-2026-89079

Summary

The Theme My Login plugin allows unauthenticated attackers to change any user's password on multi-site WordPress setups due to insufficient user identity validation during password updates. This creates a critical privilege escalation vulnerability that can lead to full account takeover.

Exploitability

Exploitation is straightforward with no prerequisites, requiring only access to the plugin's password reset endpoint on affected multi-site installations.

Blast radius

The impact could be severe across multiple user accounts and sites within a multi-site WordPress network, potentially allowing attackers to gain persistent access to administrator accounts and compromise entire networks.

Detection

Monitor for unusual password reset requests in WordPress logs, particularly those occurring without prior authentication attempts, and watch for failed login attempts followed immediately by successful password changes.

Prioritized remediation

Upgrade to version 7.2.2 or later which contains the fix for this privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.