Key points
- CVE-2026-89079 affects Theme My Login versions up to and including 7.2.1
- Unauthenticated attackers can take over accounts on multi-site WordPress setups
- The flaw allows password changes without proper identity validation
The Theme My Login plugin for WordPress has a critical security flaw in versions up to and including 7.2.1. The vulnerability allows attackers to escalate privileges and take over user accounts. This issue is tracked as CVE-2026-89079. The National Vulnerability Database rates the flaw as critical with a CVSS score of 9.8.
In plain English
The plugin fails to properly check a user’s identity before allowing a password update. This makes it possible for unauthenticated attackers to change arbitrary user passwords. The risk applies specifically to multi-site setups in certain configurations. The attack does not require the attacker to log in first.
The background
The Theme My Login plugin is developed by jfarthing84. It is designed to manage login interfaces on WordPress sites. The flaw stems from inadequate server-side validation of the user making the request. Because the plugin does not properly validate identity prior to updating passwords, it executes the change blindly.
What changes now
Site administrators must verify their current plugin version immediately. If the site runs version 7.2.1 or earlier, it is vulnerable. Upgrading to a newer version that addresses this validation gap is the required fix. There is no mention of an official patch release in the provided source material, so users must check for the latest available version from the plugin directory.
Who needs to act first
Teams should prioritize sites with public-facing login pages and multi-site architectures. Before updating, create a full backup of the database and files. Test the update in a staging environment to ensure compatibility with other plugins. Monitor authentication logs for unusual activity. Restrict access to administrative areas if an immediate fix is not available.
What to do and how to stay safe: WordPress
- Check the installed version of Theme My Login against the affected range
- Update to the latest available version from the official WordPress repository
- Monitor server logs for unauthorized password change attempts
- Disable the plugin if no secure update is immediately available
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Theme My Login are affected?
Versions up to and including 7.2.1 are vulnerable to CVE-2026-89079.
What can an attacker do with this flaw?
Unauthenticated attackers can change arbitrary user passwords on multi-site setups in certain configurations.
Is this a critical severity issue?
Yes, the NVD rates CVE-2026-89079 as critical with a CVSS score of 9.8.
