CVE-2026-81583

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them.

Score

CVSS 3.1 5.4 Medium

Status

Deferred - contact@wpscan.com

Published

2026-09-02

Last modified

2026-09-02

Weaknesses

CWE-269

Affected products

• Theme My Login (Unknown)

References

• https://wpscan.com/vulnerability/6ced93ee-5629-42a4-9103-44cf99265bd2/