CVE-2026-89079

9.8 Critique

Publiée le 16/10/2026 à 08:17 · Modifiée le 16/10/2026 à 20:19 · Analyse NVD reportée · Source : security@wordfence.com

Description

The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.

Traduire en français

Produits concernés

jfarthing84 Theme My Login

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	security@wordfence.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-269

Références

https://plugins.trac.wordpress.org/changeset/3696081/theme-my-login
https://www.wordfence.com/threat-intel/vulnerabilities/id/53c548be-b8aa-4949-93f8-7b4d73688540?source=cve

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories