Missing Authorization Flaw in Theme My Login Plugin for WordPress

CVE-2026-83628

What is CVE-2026-83628?

The Theme My Login plugin for WordPress, specifically in versions up to and including 7.1.15, presents a security risk due to a missing authorization enforcement in Multisite installations. This vulnerability occurs within the tml_ms_signup_handler() function, particularly in the gimmeanotherblog branch, where the plugin inadequately verifies the network's active_signup registration policy by relying solely on is_user_logged_in(). Unlike other branches that fully apply the necessary access controls, this oversight allows authenticated attackers with Subscriber-level access or higher to exploit the signup route. By sending a direct POST request with stage=gimmeanotherblog, attackers can bypass configured registration policies, which may be set to none or user. Consequently, this could trigger the wpmu_create_blog() function to execute using the attacker's user ID, resulting in the automatic assignment of the Administrator role on a newly created subsite without granting elevated privileges on the main site, thus limiting the scope of the exploit yet posing significant security risks.

References