CVE-2026-89079 is a critical (CVSS 9.8) privilege escalation flaw in the Theme My Login plugin for WordPress, versions up to and including 7.2.1, that lets unauthenticated attackers change any user's password on some multisite setups.
What Is It
The Theme My Login plugin for WordPress does not properly check a user's identity before it updates their password. Wordfence reported the issue, and the record classifies it as CWE-269 (Improper Privilege Management). According to the NVD description, an unauthenticated attacker can use the flaw to change any user's password on WordPress multisite setups "in certain configurations," which can lead to account takeover. The record does not say which configurations are exposed.
Why It Matters
Wordfence scored the flaw CVSS 3.1 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means an attacker can exploit it over the network, the attack is simple, and it needs no privileges or user interaction. Confidentiality, integrity and availability impact are all rated high. If an attacker can reset any user's password, they can take over privileged accounts, including administrators, on an affected site.
The CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing. The supplied sources do not confirm active exploitation. NVD published the record on 2026-10-16 with status "Received," so it has not been fully analyzed yet.
What's Vulnerable
- Vendor: jfarthing84
- Product: Theme My Login (WordPress plugin)
- Affected versions: all versions up to and including 7.2.1
- Exposure condition: WordPress multisite setups in certain configurations
The record lists no CPEs yet.
Patch Status
The CVE references a WordPress plugin repository changeset (3696081) for Theme My Login, which suggests the code has been changed. The supplied record does not name a fixed version. Administrators should:
- check which version of Theme My Login is installed
- update past 7.2.1 once a fixed release is confirmed in the plugin repository or the Wordfence advisory
- give multisite installs top priority
If you can't update right away, consider disabling the plugin on multisite networks until a fixed version is installed. There is no CISA KEV entry, so there is no federal remediation deadline.