CVE-2026-83628: Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage
The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tmlmssignuphandler() function's gimmeanotherblog branch failing to enforce the network's activesignup registration policy, checking only isuserloggedin() while sibling branches such as validate-blog-signup apply the full policy gate. This makes it possible for authenticated attackers, with Subscriber-level access and above, to directly POST stage=gimmeanotherblog to Theme My Login's signup route, bypassing the configured registration policy entirely — even when it is set to none or user — which causes wpmucreateblog() to execute with the attacker's user ID, after which WordPress core assigns the Administrator role on the newly created subsite via addusertoblog(). The privilege gain is scoped to the newly created subsite only; the attacker's account retains Subscriber-level access on the main site and does not obtain Super Admin or network-level capabilities such as managenetwork or managesites.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Theme My Loginto a version that resolves this vulnerability.Fixed in 7.1.15 - Configuration
Ensure the Multisite signup/registration policy gate used by Theme My Login's signup handler is enforced for the 'gimmeanotherblog' stage (tml_ms_signup_handler): do not rely only on is_user_logged_in(); apply the same full active_signup registration policy check used by sibling branches such as 'validate-blog-signup'.
WordPress Multisite (registration policy) active_signup = none or user
Event History
Frequently Asked Questions
Which deployments are exposed?
Only WordPress Multisite installations using Theme My Login versions up to and including 7.1.15 are described as affected. The issue concerns the plugin's multisite signup handling.
What access does an attacker need?
An attacker must already be authenticated and have at least Subscriber-level access. No user interaction is required, and the described path is reachable over the network by directly submitting the specified signup stage.
Does disabling site registration prevent exploitation?
No. The vulnerable handler does not enforce the network's active_signup policy, so the bypass works even when registration is configured as none or user.
What privilege does successful exploitation provide?
The attacker becomes an Administrator only on the newly created subsite. Their access on the main site remains Subscriber-level, and they do not gain Super Admin or network-management capabilities.