CVE-2026-81583: Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: My Loginto a version that resolves this vulnerability.Fixed in 7.2.0 - Configuration
On multisite installations, ensure the network's registration setting is enforced for site signups so subscriber and unauthenticated users cannot create new sites and gain administrator privileges.
WordPress multisite network registration setting = Enforced (ensure site signups require network registration/approval)
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects WordPress multisite installations using the My Login plugin before version 7.2.0. It concerns the plugin's handling of site signups in a network environment.
What level of access does an attacker need?
A user with a subscriber account can create a new site and receive administrator control over that site. On some networks, unauthenticated users may also be able to do this.
Are networks with registration disabled still exposed?
Yes. The vulnerability exists because the plugin does not enforce the network's registration setting when processing site signups, so a disabled registration setting may not prevent unauthorized site creation.
What is the available remediation version?
Upgrade the My Login plugin to version 7.2.0 or later. The affected versions are those before 7.2.0.