Privilege Escalation in Theme My Login Plugin for WordPress

CVE-2026-89079

What is CVE-2026-89079?

The Theme My Login plugin for WordPress is susceptible to a privilege escalation vulnerability that allows an unauthenticated user to compromise the accounts of legitimate users. This flaw arises from inadequate validation of a user's identity during password updates. The vulnerability is particularly concerning in multi-site setups where specific configurations could enable attackers to alter arbitrary user passwords, thereby gaining unauthorized access.

References