Cross Site Request Forgery in Theme My Login Plugin by WordPress
CVE-2026-66681

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Theme My Login
Vendor
CVE Published:
6 August 2026

What is CVE-2026-66681?

The Theme My Login plugin for WordPress versions up to 7.1.14 is susceptible to an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. This security flaw allows attackers to execute unauthorized actions on behalf of users without their knowledge, potentially leading to severe consequences for website integrity and user data. It is essential for users and administrators to update to the latest version to mitigate this security risk. For further details, refer to the official resource.

Affected Version(s)

Theme My Login <= 7.1.14

References

https://patchstack.com/database/wordpress/plugin/theme-my...
vdb-entry

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program
.