Vulnerabilities / Theme My Login / WPSEC-2026-0908
Theme My Login <= 7.3.0 - Cross-Site Request Forgery to Multisite Site Creation via Signup Form
Medium 4.3
CWE-352Fixed in 7.3.1
- ID
- WPSEC-2026-0908
- Plugin
- Theme My Login (theme-my-login)
- Affected
- all versions before 7.3.1
- Remediation
- Update to 7.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- Theme My Login on WPSec AttackSurface
- Fix released
- Published
Description
The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery via the multisite signup form in all versions up to, and including, 7.3.0, due to missing nonce validation in the tml_ms_signup_handler() function. This makes it possible for unauthenticated attackers to create a new site owned by a logged-in user through the 'gimmeanotherblog' signup stage, using a forged request, if they can trick that user into performing an action such as clicking a link. This only affects multisite networks that allow site signups.
References
- https://wpsec.com/vuln/WPSEC-2026-0908/
- https://plugins.svn.wordpress.org/theme-my-login/tags/7.3.1/
- https://wordpress.org/plugins/theme-my-login/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS