Theme My Login

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Theme My Login

Information

Software Type Plugin
Software Slug theme-my-login (view on wordpress.org)
Software Status Active
Software Author jfarthing84
Software Website thememylogin.com
Software Downloads 4,477,436
Software Active Installs 50,000
Software Record Last Updated October 16, 2026

8 Vulnerabilities

Submit a Vulnerability
Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
9.8
CVE-2026-89079
Oct 15, 2026
Researcher: R3D
Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage
4.3
CVE-2026-83628
Sep 4, 2026
Researcher: Maksim Hayder (tr_jan)
Theme My Login 7.0 - 7.1.15 - Authenticated (Subscriber+) Privilege Escalation
6.3
CVE-2026-81583
Sep 3, 2026
Researcher: Jakub Herman
Theme My Login <= 7.1.14 - Cross-Site Request Forgery
4.3
CVE-2026-66681
Aug 6, 2026
Researcher: Ananda Dhakal
Theme My Login <= 7.1.12 - Missing Authorization
5.3
CVE-2025-60098
Sep 26, 2025
Researcher: Psai
Theme My Login <= 7.1.7 - Cross-Site Request Forgery to Settings Update
4.3
CVE-2024-7422
Aug 15, 2024
Researcher: vgo0
Theme My Login <= 7.1.6 - Missing Authorization to Notice Dismissal
4.3
CVE-2024-32525
Apr 15, 2024
Researcher: Abdi Pranata
Theme My Login <= 6.3.9 - Local File Inclusion
8.8
CVE-2014-5155
Jun 30, 2014
Researchers: Mallory Adams, dwxsupport
Title Status CVE ID CVSS Researchers Date
Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter Patched CVE-2026-89079 9.8 R3D October 15, 2026
Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage Patched CVE-2026-83628 4.3 Maksim Hayder (tr_jan) September 4, 2026
Theme My Login 7.0 - 7.1.15 - Authenticated (Subscriber+) Privilege Escalation Patched CVE-2026-81583 6.3 Jakub Herman September 3, 2026
Theme My Login <= 7.1.14 - Cross-Site Request Forgery Patched CVE-2026-66681 4.3 Ananda Dhakal August 6, 2026
Theme My Login <= 7.1.12 - Missing Authorization Patched CVE-2025-60098 5.3 Psai September 26, 2025
Theme My Login <= 7.1.7 - Cross-Site Request Forgery to Settings Update Patched CVE-2024-7422 4.3 vgo0 August 15, 2024
Theme My Login <= 7.1.6 - Missing Authorization to Notice Dismissal Patched CVE-2024-32525 4.3 Abdi Pranata April 15, 2024
Theme My Login <= 6.3.9 - Local File Inclusion Patched CVE-2014-5155 8.8 Mallory Adams, dwxsupport June 30, 2014

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation