CVE-2026-81583 My Login CVE debrief

Who should care

WordPress multisite administrators, security teams, and users with subscriber accounts should review and update the My Login WordPress plugin to version 7.2.0 or later. They should also restrict site signups on multisite installations to authorized users and monitor for suspicious site creation activity.

Technical summary

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations. This allows users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator privileges over them. The vulnerability has a CVSS score of 5.4 and is classified as MEDIUM severity. Affected product deployments should be verified, and official advisories should be reviewed to validate affected scope, severity, and vendor guidance. Defenders should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and monitor for suspicious site creation activity.

Defensive priority

Medium priority due to potential for site creation and admin privileges

Recommended defensive actions

• Review and update My Login WordPress plugin to version 7.2.0 or later
• Restrict site signups on multisite installations to authorized users
• Monitor for suspicious site creation activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence from WPScan indicates vulnerability in My Login WordPress plugin before 7.2.0. Official CVE and NVD records provide additional context. The vulnerability allows users with a subscriber account and unauthenticated users on some networks to create new sites and be granted administrator privileges over them. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.