Theme My Login Vulnerabilities

The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user'...

CVSS:

9.8

(Wordfence)

Affected:

up to 7.2.1

Fixed in:

7.2.2

Disclosed:

Oct 15, 2026

CVE-2026-89079 on NVD →

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the `tml_ms_signup_handler()` function's `gimmeanotherblog` branch failing to enforce the network's `active_signup` registration policy, checking only `is_us...

CVSS:

4.3

(Wordfence)

Affected:

up to 7.1.15

Fixed in:

7.2.0

Disclosed:

Sep 4, 2026

CVE-2026-83628 on NVD →

The Theme My Login plugin for WordPress is vulnerable to Privilege Escalation in versions 7.0 through 7.1.15. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for authenticated attackers, with subscriber-level access and above, to elevate their privileges b...

CVSS:

6.3

(Wordfence)

Affected:

7.0 – 7.1.15

Fixed in:

7.2.0

Disclosed:

Sep 3, 2026

CVE-2026-81583 on NVD →

The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.1.14. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can t...

CVSS:

4.3

(Wordfence)

Affected:

up to 7.1.14

Fixed in:

7.1.15

Disclosed:

Aug 6, 2026

CVE-2026-66681 on NVD →

The Theme My Login plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 7.1.12. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

(Wordfence)

Affected:

up to 7.1.12

Fixed in:

7.1.13

Disclosed:

Sep 26, 2025

CVE-2025-60098 on NVD →

[en] Missing Authorization vulnerability in Jeff Farthing Theme My Login allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Theme My Login: from n/a through 7.1.12.

Affected:

up to 7.1.13

Fixed in:

7.1.13

Disclosed:

Sep 26, 2025

CVE-2025-60098 on NVD →

[en] The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tml_admin_save_ms_settings() function. This makes it possible for unauthenticated attackers to update the theme's settings via...

Affected:

up to 7.1.8

Fixed in:

7.1.8

Disclosed:

Aug 16, 2024

CVE-2024-7422 on NVD →

The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tml_admin_save_ms_settings() function. This makes it possible for unauthenticated attackers to update the theme's settings via a fo...

CVSS:

4.3

(Wordfence)

Affected:

up to 7.1.7

Fixed in:

7.1.8

Disclosed:

Aug 15, 2024

CVE-2024-7422 on NVD →

[en] Missing Authorization vulnerability in Theme My Login.This issue affects Theme My Login: from n/a through 7.1.6.

Affected:

up to 7.1.7

Fixed in:

7.1.7

Disclosed:

Apr 17, 2024

CVE-2024-32525 on NVD →

The Theme My Login plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tml_admin_ajax_dismiss_notice() function in all versions up to, and including, 7.1.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to dismiss...

CVSS:

4.3

(Wordfence)

Affected:

up to 7.1.6

Fixed in:

7.1.7

Disclosed:

Apr 15, 2024

CVE-2024-32525 on NVD →

Because of this vulnerability, attackers can access to any non-PHP file or execute arbitrary code. Update plugin.

Affected:

up to 6.3.10

Fixed in:

6.3.10

Disclosed:

May 15, 2015

The Theme My Login plugin for WordPress is vulnerable to Local File Inclusion in versions before 6.3.10 via the login_template attribute found in the theme-my-login shortcode. This allows authenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files....

CVSS:

8.8

(Wordfence)

Affected:

up to 6.3.10

Fixed in:

6.3.10

Disclosed:

Jun 30, 2014

CVE-2014-5155 on NVD →

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 6.3.10

Fixed in:

6.3.10

CVE-2014-5155 on NVD →

The Theme My Login WordPress plugin was affected by a Local File Inclusion security vulnerability.

Affected:

up to 6.3.10

Fixed in:

6.3.10