The Theme My Login plugin before version 7.2.0 fails to enforce the network registration setting during multisite site sign‑ups, permitting subscriber‑level users and, on some networks, unauthenticated users to create new sites and automatically assume administrator privileges on those sites. This flaw allows attackers to gain full control over once‑created WordPress sites, enabling content tampering, malware deployment, or alteration of site configuration. The vulnerability is a privilege escalation that circumvents normal registration control mechanisms and involves weaknesses described by CWE-269.

Any WordPress multisite network using the Theme My Login plugin with a version older than 7.2.0 is affected. Single‑site WordPress installations or plugin versions 7.2.0 and newer are not impacted. The plugin vendor is listed as Unknown:Theme My Login.

The likely attack vector is the standard multisite site registration process: an attacker submits a site creation request, which the plugin accepts regardless of the network's registration setting, assigning the requester an administrator role by default. No additional privileges are required to exploit this path. The CVSS score of 5.4 categorises the risk as moderate; the EPSS score of 0.00136 indicates a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, accidental administrator access can result in significant damage to the WordPress network.