The My Login WordPress plugin, before version 7.2.0, fails to enforce the network registration setting during multisite site sign‑ups. This flaw allows users who are merely subscribers, or even unauthenticated users on certain networks, to create new sites and be granted administrator privileges over those sites, giving them full control over the site and its content. The vulnerability is a classic privilege escalation resulting in unauthorized administrative access.

The vulnerability affects the Theme My Login plugin installed on WordPress multisite networks. All plugin versions prior to 7.2.0 are impacted. Site owners should check the installed version and apply the update if the version is within the affected range.

Attackers need only submit a site sign‑up request on a multisite network where the network setting that normally blocks registration is ignored. The new site is provisioned and the plugin assigns it an administrator role. The condition does not require additional authentication, so the risk remains high for networks that permit ordinary subscribers or unauthenticated users to sign up for sites. The EPSS score is not available, the likelihood is uncertain but the impact is severe, and the flaw is not currently listed in the CISA KEV catalog. Nevertheless, gaining administrator control over a site represents a critical breach of authorization boundaries.