CVE-2026-81583: CWE-269 Improper Privilege Management in Theme My Login

CVE-2026-81583 is an improper privilege management vulnerability (CWE-269) in the Theme My Login WordPress plugin versions before 7.2.0. The plugin does not enforce multisite network registration settings when processing site signups, which permits users with subscriber-level access and unauthenticated users on certain networks to create new sites and obtain administrator rights over these sites. This flaw can lead to unauthorized privilege escalation within multisite WordPress environments.

Exploitation of this vulnerability allows low-privileged or unauthenticated users to create new sites within a multisite WordPress network and gain administrator privileges on those sites. This can lead to unauthorized administrative control, potentially enabling further malicious actions within the affected sites. The vulnerability does not impact confidentiality but affects integrity and availability to a limited extent.

No official patch or remediation is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting site signup capabilities and closely monitor multisite registration settings to mitigate risk.