Theme My Login Multisite ATO (CVE-2026-89079): tml_user_passwords and Lost-Password user_pass1

Lost password is not “email only” on multisite

CVE-2026-89079 hits Theme My Login on WordPress multisite when the network enables tml_user_passwords — letting registrants choose passwords during signup. In ≤ 7.2.1, the multisite filter tml_ms_filter_pre_insert_user_data() can apply attacker-supplied user_pass1 during core retrieve_password(), ending in wp_update_user(). That is unauthenticated account takeover (CWE-269, CVSS 3.1 9.8).

Fixed in 7.2.2+ (upstream commit 06b7623).

PoC: CVE-2026-89079 on pocbit.org. Plugin: Theme My Login on WordPress.org.

Why scanners lie to you here

| Signal | Trap | |--------|------| | readme ≤ 7.2.1 | Single-site TML is often not exploitable via this path | | checkemail=confirm after lost-password POST | Normal WordPress UX — not proof the password changed | | /register/ on TML | Looks like “multisite signup” but may be single-site theme routing |

Exploitation needs real is_multisite(), tml_user_passwords site option, and the vulnerable hook chain. The public PoC separates check, verify-only, and exploit for that reason.

Cross-read: WordPress security checklist (2026), authentication bypass — what to check, WordPress plugin vulnerabilities defender guide.

Defender checklist

| # | Action | Detail | |---|--------|--------| | 1 | Network inventory | Every subsite — is Theme My Login active? Version from plugin readme or file hash | | 2 | Upgrade | ≥ 7.2.2 network-wide | | 3 | Option audit | tml_user_passwords — disable until patched if you cannot upgrade immediately | | 4 | Log review | Unauthenticated POSTs to lost-password URLs with user_pass1 | | 5 | Staging proof | PoC --verify-only on lab multisite before declaring “exploitable” on prod | | 6 | User comms | Force password reset for network admins if you observed probing |

Patch validation

1. Disposable WP multisite lab with TML 7.2.1, tml_user_passwords on.
2. python poc.py --check → eligible heuristics.
3. Controlled --mode exploit against a test subscriber, then upgrade to 7.2.2 and repeat (expect failure).

See safe PoC lab setup and CVE PoC testing step-by-step.

FAQ

We run TML on single-site only — skip?

For this CVE’s multisite hook, yes — but still upgrade; other fixes ship in 7.2.2 too.

Multisite but plugin disabled network-wide?

No TML → not in scope for this bug class on that network.

Bottom line

CVE-2026-89079 is a reminder that network options + password-reset code paths are ATO surfaces on WordPress multisite. Do not stop at version grep — confirm multisite + tml_user_passwords, patch to 7.2.2+, and treat lost-password forms like credential APIs.