CVE-2025-60098: Theme My Login Auth Bypass Vulnerability

CVE-2025-60098 Overview

CVE-2025-60098 is a Missing Authorization vulnerability [CWE-862] in the Jeff Farthing Theme My Login plugin for WordPress. The flaw affects all versions of Theme My Login up to and including 7.1.12. Attackers can exploit incorrectly configured access control security levels to reach functionality that should require authorization. The issue is network-exploitable, requires no privileges, and needs no user interaction.

Critical Impact
Unauthenticated attackers can abuse missing authorization checks in Theme My Login to interact with restricted plugin functionality, resulting in limited integrity and availability impact on affected WordPress sites.

Affected Products

Jeff Farthing Theme My Login WordPress plugin
All versions from n/a through <= 7.1.12
WordPress sites using Theme My Login for login page customization

Discovery Timeline

2025-09-26 - CVE-2025-60098 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60098

Vulnerability Analysis

CVE-2025-60098 is a Broken Access Control issue in the Theme My Login plugin. The plugin exposes functionality without properly verifying that the requesting user holds the required capability or role. This maps to Common Weakness Enumeration category [CWE-862] Missing Authorization.

The attack vector is Network with low complexity, and no authentication is required to reach the vulnerable code paths. Successful exploitation produces low integrity and low availability impact, while confidentiality is not affected according to the published metrics.

Operators running Theme My Login on public WordPress deployments should treat any version at or below 7.1.12 as vulnerable. According to the Exploit Prediction Scoring System, the current probability of exploitation is 0.287% at the 20.8 percentile, but plugin-level access control flaws are commonly weaponized once details are widely available.

Root Cause

The root cause is missing or insufficient authorization checks on one or more plugin endpoints. The plugin appears to rely on incorrectly configured access control security levels rather than enforcing capability checks such as current_user_can() before performing sensitive operations. This design flaw allows requests to bypass intended role-based restrictions.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to plugin endpoints that lack proper authorization enforcement. Because the request reaches functionality it should not, the attacker can trigger actions or state changes intended only for privileged users. See the Patchstack Vulnerability Report for the specific endpoint details.

No public proof-of-concept exploit is currently listed for CVE-2025-60098, and it is not present on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-60098

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to Theme My Login admin-ajax.php actions or plugin REST routes originating from unexpected IP addresses.
Unexpected changes to plugin settings, user metadata, or login page configuration inside WordPress without a corresponding administrator session.
Web server logs showing anonymous access followed by privileged plugin actions succeeding with HTTP 200 responses.

Detection Strategies

Inventory all WordPress installations and identify sites running Theme My Login at version 7.1.12 or earlier.
Enable WordPress audit logging to record changes to plugin options and user records, then alert on modifications performed without an authenticated administrator context.
Deploy Web Application Firewall (WAF) rules that inspect requests to Theme My Login endpoints and flag calls from unauthenticated sessions.

Monitoring Recommendations

Monitor access logs for spikes in requests targeting Theme My Login handlers, particularly from single source addresses.
Correlate WordPress user activity with authentication events to identify actions taken without a valid login.
Alert on any creation, modification, or deletion of user accounts that cannot be tied to a legitimate administrator session.

How to Mitigate CVE-2025-60098

Immediate Actions Required

Identify every WordPress site running Theme My Login <= 7.1.12 and prioritize updates on internet-facing deployments.
Update the plugin to the vendor-supplied fixed release as referenced in the Patchstack Vulnerability Report.
Review WordPress user accounts and plugin settings for unauthorized changes made prior to patching.

Patch Information

Refer to the vendor advisory published through Patchstack for the fixed version and release notes. Site owners should apply the latest available Theme My Login release beyond 7.1.12 and validate that the plugin is active only where required.

Workarounds

Deactivate and remove Theme My Login on sites where the plugin is not essential until an update is applied.
Restrict access to WordPress admin-ajax.php and REST endpoints associated with Theme My Login using WAF rules or server-level access controls.
Enforce IP allowlisting on wp-admin and administrative endpoints to reduce the exposed attack surface.

bash

# Configuration example: block unauthenticated access to Theme My Login endpoints at the web server layer
# Nginx example - restrict Theme My Login plugin paths to authenticated sessions
location ~* /wp-content/plugins/theme-my-login/ {
    deny all;
    return 403;
}

# WP-CLI: verify installed plugin version and update
wp plugin get theme-my-login --field=version
wp plugin update theme-my-login