The Theme My Login plugin in WordPress versions up to 7.2.1 has a privilege escalation flaw that allows unauthenticated attackers to change any user’s password. The vulnerability arises because the plugin does not verify the requester’s identity before applying a new password supplied via the 'user_pass1' POST parameter in the wp_pre_insert_user_data filter. This issue corresponds to CWE-269. Because the flaw is exploitable without authentication, an attacker can take over any account in a multisite environment by simply posting a forged request. This results in full loss of confidentiality, integrity, and availability for affected accounts.

The affected systems are any WordPress installations that have the Theme My Login plugin 7.2.1 or earlier installed, especially those running a multisite network. All sites within the network share the same user database, so a password change on the primary site can affect users across all sites. WordPress sites that are not multisite are less likely to be impacted unless the plugin is used in a context where the filter runs during user creation or reset.

The CVSS score of 9.8 indicates critical severity. Because no authentication is required and the plugin is widely used in WordPress sites, the attack surface is high. The EPSS score is less than 1%, indicating a very low probability of exploitation; however, the lack of an authentication barrier combined with the plugin’s prevalence suggests exploitation is still possible. The vulnerability is not listed in the CISA KEV catalog, but the potential for widespread account takeover warrants immediate remediation.