WordPress theme My Login plugin 7.0-7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability

Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation vulnerability discovered by Jakub Herman in WordPress Plugin Theme My Login versions 7.0-7.1.15...

CVE-2026-81583

The My Login WordPress plugin (versions 7.0-7.1.15 ) contains a vulnerability where it fails to enforce the network's registration setting during site signups on multisite installations . This flaw allows users with a subscriber account, and in some cases unauthenticated users, to create new site...

CVE-2026-81583 Theme My Login 7.0 - 7.1.15 - Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation

The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them...