The Theme My Login plugin for WordPress has a critical vulnerability allowing unauthenticated attackers to change arbitrary user passwords on multi-site setups in certain configurations due to improper identity validation before password updates. This vulnerability, CVE-2026-89079, is a result of the plugin not properly validating a user's identity prior to updating their password, which could lead to acc [truncated]
The Theme My Login plugin for WordPress has a Missing Authorization vulnerability in versions up to 7.1.15 on Multisite installations. This allows authenticated attackers with Subscriber-level access and above to bypass the configured registration policy and create a new subsite with Administrator role. The vulnerability arises from the `tml_ms_signup_handler()` function's `gimmeanotherblog` branch failin [truncated]
