Summary
generated automatically from NVD dataThe Theme My Login plugin for WordPress, in versions up to and including 7.2.1, contains a privilege escalation flaw that leads to account takeover. The plugin does not properly validate a user's identity before updating their password, so unauthenticated attackers can change the passwords of arbitrary users on multi-site setups in certain configurations. The flaw is classified as CWE-269 and carries a CVSS v3.1 score of 9.8 (CRITICAL).
NVD description
The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.
EPSS · FIRST.org
0.29%probability of exploitation in the next 30 days
Higher than 20% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 16 oct. 2026
- Updated
- 16 oct. 2026
- Status
- Deferred
- Source
- security@wordfence.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-269
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.