Theme My Login Vulnerabilities

The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.1.14. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can t...

CVSS:

4.3

Affected:

up to 7.1.14

Fixed in:

7.1.15

Disclosed:

Aug 6, 2026

CVE-2026-66681 on NVD →

The Theme My Login plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 7.1.12. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 7.1.12

Fixed in:

7.1.13

Disclosed:

Sep 26, 2025

CVE-2025-60098 on NVD →

[en] Missing Authorization vulnerability in Jeff Farthing Theme My Login allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Theme My Login: from n/a through 7.1.12.

Affected:

up to 7.1.13

Fixed in:

7.1.13

Disclosed:

Sep 26, 2025

CVE-2025-60098 on NVD →

[en] The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tml_admin_save_ms_settings() function. This makes it possible for unauthenticated attackers to update the theme's settings via...

Affected:

up to 7.1.8

Fixed in:

7.1.8

Disclosed:

Aug 16, 2024

CVE-2024-7422 on NVD →

The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tml_admin_save_ms_settings() function. This makes it possible for unauthenticated attackers to update the theme's settings via a fo...

CVSS:

4.3

Affected:

up to 7.1.7

Fixed in:

7.1.8

Disclosed:

Aug 15, 2024

CVE-2024-7422 on NVD →

[en] Missing Authorization vulnerability in Theme My Login.This issue affects Theme My Login: from n/a through 7.1.6.

Affected:

up to 7.1.7

Fixed in:

7.1.7

Disclosed:

Apr 17, 2024

CVE-2024-32525 on NVD →

The Theme My Login plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tml_admin_ajax_dismiss_notice() function in all versions up to, and including, 7.1.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to dismiss...

CVSS:

4.3

Affected:

up to 7.1.6

Fixed in:

7.1.7

Disclosed:

Apr 15, 2024

CVE-2024-32525 on NVD →

Because of this vulnerability, attackers can access to any non-PHP file or execute arbitrary code. Update plugin.

Affected:

up to 6.3.10

Fixed in:

6.3.10

Disclosed:

May 15, 2015

The Theme My Login plugin for WordPress is vulnerable to Local File Inclusion in versions before 6.3.10 via the login_template attribute found in the theme-my-login shortcode. This allows authenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files....

CVSS:

8.8

Affected:

up to 6.3.10

Fixed in:

6.3.10

Disclosed:

Jun 30, 2014

CVE-2014-5155 on NVD →

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 6.3.10

Fixed in:

6.3.10

CVE-2014-5155 on NVD →

The Theme My Login WordPress plugin was affected by a Local File Inclusion security vulnerability.

Affected:

up to 6.3.10

Fixed in:

6.3.10