Theme My Login <= 7.2.1 - Privilege Escalation
Theme My Login (TML) retrieve_password() -> wp_update_user()), this filter fires on the EXISTING target user, overwriting their password with an attacker-chosen value. An unauthenticated attacker can therefore take over any account, including a network administrator, by sending user_pass1 in the lost-password POST. Fixed in 7.2.2 (changeset 3696081 / commit 06b76231) by adding the $update guard and only applying the password during activation. References: https://patchstack.com/database/wordpress/plugin/theme-my-login/vulnerability/wordpress-theme-my-login-plugin-7-2-1-unauthenticated-privilege-escalation-vulnerability https://plugins.trac.wordpress.org/changeset/3696081/theme-my-login https://github.com/theme-my-login/theme-my-login/commit/06b76231b86150eed932db52646734486ecd0781 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-89079 Remediation: Update Theme My Login to 7.2.2 or later. As mitigation, disable the tml_user_passwords network option until patched.
Used 20 times · 10 assets checked · domain, subdomain, ipv4