CVE-2026-83628: CWE-862 Missing Authorization in jfarthing84 Theme My Login

CVE-2026-83628 is a missing authorization vulnerability in the Theme My Login WordPress plugin on Multisite setups. The vulnerability arises because the gimmeanotherblog branch of the tml_ms_signup_handler() function does not enforce the network's active_signup registration policy, only checking if the user is logged in. This allows authenticated users with Subscriber-level access or above to POST stage=gimmeanotherblog to the signup route, bypassing registration policies such as none or user. Consequently, wpmu_create_blog() executes with the attacker's user ID, and WordPress assigns the Administrator role on the newly created subsite via add_user_to_blog(). The attacker's privilege gain is confined to the new subsite; no main site or network-level privileges are granted.

An authenticated attacker with Subscriber-level access or higher can bypass network registration policies to create a new subsite where they gain Administrator privileges. This unauthorized privilege escalation is limited to the newly created subsite and does not affect the main site or network-wide capabilities. There is no impact on confidentiality or availability, but integrity is impacted on the new subsite due to unauthorized administrative control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level users from accessing the signup route or disable the gimmeanotherblog functionality if possible. Monitor for plugin updates from the vendor addressing this issue.