Improper Access Control in My Login WordPress Plugin Affects Network Signups
CVE-2026-81583
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 2 September 2026
Badges
What is CVE-2026-81583?
The My Login WordPress plugin prior to version 7.2.0 is susceptible to a vulnerability that fails to adhere to the network's registration settings during the sign-up process on multisite installations. This flaw permits users with subscriber accounts and even unauthenticated individuals on certain networks to create new sites arbitrarily, subsequently gaining administrative privileges on these sites. It poses a significant risk by allowing unauthorized users to exploit network features and potentially compromise the site's integrity.
Affected Version(s)
Theme My Login 7.0 < 7.2.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.