## Overview
CVE-2026-89079 affects the Theme My Login plugin for WordPress, specifically versions up to and including 7.2.1. This vulnerability allows unauthenticated attackers to escalate privileges via account takeover.
## Technical Details
The issue stems from the plugin's failure to properly validate a user's identity before allowing password updates. In multi-site setups with certain configurations, this flaw can be exploited to change arbitrary user passwords. Attackers can leverage this vulnerability without needing any authentication.
## Impact
The critical severity rating of 9.8 on the CVSS scale indicates a high risk for affected systems. Exploitation could lead to unauthorized access to user accounts, potentially compromising sensitive information and allowing further attacks within the network. Organizations using the vulnerable versions of the plugin are at significant risk.
## Mitigation
Defenders should immediately update the Theme My Login plugin to version 7.2.2 or later. Regularly review and monitor user accounts for any unauthorized changes. Implement additional security measures, such as two-factor authentication, to further protect user accounts.
CSURFACE Threat Sensor