Vulnerabilities and security researches fortheme-my-login theme-my-login

Jun 07, 2024

CVE, Research URL: ca47f7c386320d4a755c6ab02e393c39b9affd0e
Home page URL: Security reports for Theme My Login
Application: Theme My Login
Date: May 15, 2015
Research Description: Theme My Login [theme-my-login] < 6.3.10 WordPress Theme My Login Plugin <= 6.3.9 - Local File Inclusion Because of this vulnerability, attackers can access to any non-PHP file or execute arbitrary code. Update plugin.
Affected versions: max 6.3.10.
Status: vulnerable

CVE, Research URL: CVE-2024-32525
Home page URL: Security reports for Theme My Login
Application: Theme My Login
Date: Apr 17, 2024
Research Description: Missing Authorization vulnerability in Theme My Login.This issue affects Theme My Login: from n/a through 7.1.6.
Affected versions: max 7.1.7.
Status: vulnerable

Jun 10, 2024

CVE, Research URL: CVE-2014-5155
Home page URL: Security reports for Theme My Login
Application: Theme My Login
Date: -
Research Description: The Theme My Login plugin for WordPress is vulnerable to Local File Inclusion in versions before 6.3.10 via the login_template attribute found in the theme-my-login shortcode. This allows authenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Affected versions: max 6.3.10.
Status: vulnerable

Aug 16, 2024

CVE, Research URL: CVE-2024-7422
Home page URL: Security reports for Theme My Login
Application: Theme My Login
Date: Aug 16, 2024
Research Description: The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tml_admin_save_ms_settings() function. This makes it possible for unauthenticated attackers to update the theme's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Please note that this only affects multi-site instances.
Affected versions: max 7.1.8.
Status: vulnerable

Oct 11, 2025

CVE, Research URL: CVE-2025-60098
Home page URL: Security reports for Theme My Login
Application: Theme My Login
Date: Sep 26, 2025
Research Description: Missing Authorization vulnerability in Jeff Farthing Theme My Login theme-my-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theme My Login: from n/a through <= 7.1.12.
Affected versions: max 7.1.13.
Status: vulnerable

Jun 16, 2026

CVE, Research URL: 8a6e3596b67149f6003516b0f046aeecbc210c74
Home page URL: Security reports for Theme My Login
Application: Theme My Login
Date: Jun 30, 2014
Research Description: Theme My Login [theme-my-login] < 6.3.10 Theme My Login <= 6.3.9 - Local File Inclusion The Theme My Login plugin for WordPress is vulnerable to Local File Inclusion in versions before 6.3.10 via the login_template attribute found in the theme-my-login shortcode. This allows authenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Affected versions: max 6.3.10.
Status: vulnerable

CVE, Research URL: 75696a10-352d-4eda-8304-5cf2e5de2b15
Home page URL: Security reports for Theme My Login
Application: Theme My Login
Date: -
Research Description: Theme My Login [theme-my-login] < 6.3.10 Theme My Login 6.3.9 - Local File Inclusion The Theme My Login WordPress plugin was affected by a Local File Inclusion security vulnerability.
Affected versions: max 6.3.10.
Status: vulnerable

Aug 08, 2026

CVE, Research URL: CVE-2026-66681
Home page URL: Security reports for Theme My Login
Application: Theme My Login
Date: Aug 06, 2026
Research Description: Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.
Affected versions: max 7.1.14.
Status: vulnerable

Sep 05, 2026

CVE, Research URL: CVE-2026-81583
Home page URL: Security reports for Theme My Login
Application: Theme My Login
Date: Sep 02, 2026
Research Description: The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them.
Affected versions: max 7.2.0.
Status: vulnerable

Oct 17, 2026

CVE, Research URL: CVE-2026-89079
Home page URL: Security reports for Theme My Login
Application: Theme My Login
Date: Oct 16, 2026
Research Description: The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.
Affected versions: max 7.2.2.
Status: vulnerable