Theme My Login
Theme My Login has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2026; all 8 are fixed as of October 2026. Their average CVSS score is 5.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2026 was the busiest year with 4 disclosures.
The most common weakness is Missing Authorization, behind 3 of the records (38%). Other recurring categories include Cross-Site Request Forgery (CSRF), Improper Privilege Management.
Every one of the 8 issues recorded for Theme My Login has a vendor fix available, so running the current release closes all known holes.
8 independent researchers contributed these findings, one record each. Theme My Login is installed on roughly 50,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-89079Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter
Read the full analysisVulnerability Records

Theme My Login
Author
Jeff Farthing
Theme My Login replaces the default WordPress login screen (wp-login.php) with login, registration and password reset pages that live inside your theme, so they look like the rest of your site. It works as soon as you activate it: the pages appear at /login, /register and /lostpassword by default, and WordPress’s own login, logout and registration links point to them. Features Login, registration, lost password and password reset forms on the frontend of your site, styled by your theme. Choose the URL of each page, such as /sign-in instead of /login. Let users log in with their username, their email address, or either. Let users register with just an email address, no username needed. Let users choose their own password at registration, with a strength meter and a show/hide toggle. Log new users in automatically after they register. Put the forms anywhere with the [theme-my-login] shortcode or the login widget. Add login, logout and registration links to your navigation menus. Submit forms without a page reload by turning on AJAX. Works on multisite networks, including network signup. Do More With Extensions Theme My Login is free. Paid add-ons from our extensions catalog build on it: Redirection: control where users land after they log in, log out or register, based on their role. Moderation: stop spam sign-ups by requiring email confirmation, admin approval, or both before new users can log in. Restrictions: limit posts, pages, menus and widgets to logged-in users or specific roles, or make your whole site private. Security: stop brute-force attacks with IP lockouts, set password rules, and shut off wp-login.php. reCAPTCHA: block spam bots on your login, registration, lost password and comment forms with Google reCAPTCHA. Profiles: give users a profile page that matches your theme, and keep them out of wp-admin. Notifications: rewrite WordPress’s account emails, send them as HTML, and create your own notifications for registration and password events. 2FA: add authenticator-app two-factor authentication to your login, with backup codes and the option to require 2FA for specific roles. Social: let visitors log in or register with Google, Facebook or X. Avatars: let users upload their own profile pictures instead of depending on Gravatar. Favorites: let logged-in users save posts to a personal favorites page and come back to them later. Mailchimp: add new users to your Mailchimp audiences at registration, automatically or with an opt-in checkbox.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C