CVE-2026-81583 Overview
CVE-2026-81583 is a privilege escalation vulnerability in the My Login WordPress plugin affecting versions prior to 7.2.0. The plugin fails to enforce the network's registration setting when processing site signups on multisite installations. Subscriber-level users, and unauthenticated visitors on some network configurations, can create new sites and receive administrator privileges over them. The flaw is classified under CWE-269: Improper Privilege Management.
Critical Impact
Low-privileged or unauthenticated actors can provision new sites within a WordPress multisite network and become administrators of those sites, gaining a foothold inside a trusted network.
Affected Products
- My Login WordPress plugin versions prior to 7.2.0
- WordPress multisite installations running the vulnerable plugin
- Networks where subscriber registration or open signup is exposed
Discovery Timeline
- 2026-09-02 - CVE-2026-81583 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-81583
Vulnerability Analysis
The My Login plugin extends WordPress account handling with custom login, registration, and signup flows. On multisite installations, WordPress exposes a network-level registration setting that controls whether users can register accounts, register sites, both, or neither. The plugin's signup handler processes site creation requests without consulting this setting.
As a result, the plugin executes site signup logic even when the network administrator has disabled site registration. Any authenticated subscriber can submit a signup request and receive administrator rights on the newly created site. On networks with more permissive front-end exposure, unauthenticated requests also succeed. This aligns with [CWE-269] where privileges are granted outside the intended policy boundary.
Root Cause
The root cause is a missing authorization check in the site signup processing path. The plugin does not verify the registration option value returned by the network settings before creating a new blog and assigning the requester as administrator. Trust is placed in the presence of the signup form rather than the server-side policy.
Attack Vector
The attack vector is network-based over HTTP or HTTPS. An attacker with a subscriber account, or an unauthenticated attacker on affected networks, submits a crafted signup request to the plugin endpoint. The request specifies the desired site slug and title. The plugin provisions the site and grants the attacker the administrator role on it, allowing plugin installation, theme upload, and content publishing within that site's scope.
See the WPScan Vulnerability Report for further technical detail.
Detection Methods for CVE-2026-81583
Indicators of Compromise
- Unexpected entries in the wp_blogs table on multisite installations, particularly sites owned by low-privileged users.
- New administrator role assignments in wp_usermeta for freshly created blog IDs correlated with subscriber accounts.
- HTTP POST requests to the My Login signup endpoint from unauthenticated sessions or subscriber-level cookies.
Detection Strategies
- Audit multisite site inventory and compare creation timestamps against periods when network registration was disabled.
- Review web server access logs for POST requests targeting the plugin's signup handler, filtering by response codes indicating successful site creation.
- Correlate WordPress audit logs with user role assignments to identify subscribers who obtained administrator rights on new sites.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record site creation events and role changes in real time.
- Forward WordPress and web server logs to a centralized logging pipeline for retention and alerting on signup anomalies.
- Alert on any site creation event that occurs while the network registration option is set to none or user.
How to Mitigate CVE-2026-81583
Immediate Actions Required
- Update the My Login plugin to version 7.2.0 or later on every site in the multisite network.
- Enumerate sites created since the plugin was installed and remove any provisioned by unauthorized users.
- Revoke administrator rights granted through unauthorized signups and reset credentials for the affected accounts.
Patch Information
Upgrade the My Login WordPress plugin to version 7.2.0 or later, which enforces the network's registration setting before processing site signups. Refer to the WPScan Vulnerability Report for advisory details and vendor references.
Workarounds
- Deactivate the My Login plugin across the network until the update to 7.2.0 is applied.
- Restrict access to the plugin's signup endpoint at the web server or WAF layer, blocking unauthenticated and subscriber-level POST requests.
- Set the multisite network registration option to none and monitor for any site creation attempts that bypass this setting.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
