CVE-2026-83628

Name of the Vulnerable Software and Affected Versions Theme My Login versions prior to 7.1.16

Description On Multisite installations, a missing authorization issue exists within the tml ms signup handler() function. Specifically, the gimmeanotherblog branch fails to enforce the network's active signup registration policy, verifying only if the user is logged in via is user logged in(). This allows authenticated attackers with Subscriber-level access or higher to send a POST request with the parameter stage=gimmeanotherblog to the signup route. This action bypasses the registration policy and triggers wpmu create blog(), resulting in the attacker being assigned the Administrator role on the newly created subsite through add user to blog(). The privilege escalation is limited to the new subsite; the attacker does not gain Super Admin or network-level capabilities such as manage network or manage sites on the main site.

Recommendations Update to a version newer than 7.1.15.