CVE-2026-83628: Theme My Login Privilege Escalation Flaw

CVE-2026-83628 Overview

CVE-2026-83628 is a Missing Authorization vulnerability [CWE-862] in the Theme My Login plugin for WordPress, affecting versions up to and including 7.1.15 on Multisite installations. The flaw resides in the tml_ms_signup_handler() function's gimmeanotherblog branch, which fails to enforce the network's active_signup registration policy. Authenticated attackers with Subscriber-level access or higher can bypass the configured registration policy and create a new subsite where WordPress core assigns them the Administrator role. The privilege escalation is scoped to the newly created subsite only and does not grant Super Admin or network-level capabilities.

Critical Impact
Subscriber-level users on WordPress Multisite installations can create arbitrary subsites and gain Administrator role on them, even when network registration is disabled.

Affected Products

Theme My Login plugin for WordPress, versions up to and including 7.1.15
WordPress Multisite installations with Theme My Login installed
Networks with active_signup set to none, user, blog, or all

Discovery Timeline

2026-09-05 - CVE-2026-83628 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-83628

Vulnerability Analysis

The vulnerability exists in the tml_ms_signup_handler() function within includes/ms-functions.php of the Theme My Login plugin. The handler routes signup requests based on the stage POST parameter, with each branch responsible for enforcing appropriate policy checks. The gimmeanotherblog branch performs only an is_user_logged_in() check, while sibling branches such as validate-blog-signup apply the full active_signup policy gate. This inconsistency allows any authenticated user to reach the blog creation code path regardless of network configuration.

Once the check passes, the handler invokes wpmu_create_blog() using the attacker's user ID. WordPress core then calls add_user_to_blog(), which assigns the Administrator role to the creating user on the newly provisioned subsite. The attack succeeds even when the network administrator has explicitly disabled registration by setting active_signup to none.

Root Cause

The root cause is inconsistent authorization enforcement across signup branches in tml_ms_signup_handler(). The gimmeanotherblog code path treats authenticated status as sufficient authorization, omitting the policy check that sibling branches enforce. This violates the principle of complete mediation for security-relevant actions.

Attack Vector

An attacker with Subscriber-level access sends a POST request to Theme My Login's signup route with stage=gimmeanotherblog and the required blog parameters. The handler bypasses the registration policy check and creates the requested subsite. WordPress core subsequently grants the attacker Administrator privileges on that subsite. See the WordPress Code Snippet at line 580 and the Wordfence Vulnerability Report #72585 for full technical details.

Detection Methods for CVE-2026-83628

Indicators of Compromise

POST requests to the Theme My Login signup endpoint containing the parameter stage=gimmeanotherblog from low-privileged user sessions
Unexpected entries in the wp_blogs table created by non-administrator user IDs
New Administrator role assignments in subsite wp_*_usermeta tables tied to Subscriber-level accounts on the main site
Subsite creation events in WordPress logs originating from users lacking Super Admin capabilities

Detection Strategies

Audit wp_blogs and wp_registration_log tables for subsite creation activity by users without manage_sites or manage_network capabilities
Enable WordPress Multisite logging plugins to capture wpmu_new_blog action hooks and correlate with the initiating user ID
Review web server access logs for POST requests to Theme My Login URLs containing stage=gimmeanotherblog

Monitoring Recommendations

Alert on any invocation of wpmu_create_blog() where the calling user lacks Super Admin status
Monitor for role changes to administrator on newly created subsites, particularly when the user holds only Subscriber rights on the primary site
Track the plugin version deployed across the environment to identify installations still running Theme My Login 7.1.15 or earlier

How to Mitigate CVE-2026-83628

Immediate Actions Required

Update the Theme My Login plugin to version 7.2.0 or later on all WordPress Multisite installations
Audit existing subsites for unauthorized creation by low-privileged accounts and remove any illegitimate sites
Review Administrator role assignments across all subsites and revoke privileges granted through this vector

Patch Information

The vendor addressed CVE-2026-83628 in Theme My Login version 7.2.0. The fix is documented in WordPress Changeset #3669721, which adds proper active_signup policy enforcement to the gimmeanotherblog branch. A complete diff between the vulnerable and fixed versions is available in the Changeset Comparison 7.1.15 to 7.2.0.

Workarounds

Deactivate the Theme My Login plugin on Multisite installations until the update to 7.2.0 can be applied
Restrict Subscriber account creation on the main site to trusted users only, reducing the pool of accounts that can exploit the flaw
Implement a Web Application Firewall (WAF) rule to block POST requests containing stage=gimmeanotherblog from non-administrator sessions

bash

# Example WAF rule pattern to block the exploit path
# Block POST requests to Theme My Login endpoints where stage=gimmeanotherblog
# is submitted by users without Super Admin capability
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,msg:'CVE-2026-83628 exploit attempt'"
SecRule ARGS:stage "@streq gimmeanotherblog"