Executive brief
The Theme My Login plugin for WordPress multisite installations fails to enforce network registration policies in its blog signup handler. An authenticated user with basic Subscriber access can bypass the network's configured registration restrictions and create new subsites with Administrator privileges on those sites, disrupting site governance and expanding their control beyond their intended permissions.
Technical details
The vulnerability is a missing authorization check in the `tml_ms_signup_handler()` function's `gimmeanotherblog` branch. The function checks only `is_user_logged_in()` while other branches properly enforce the `active_signup` network policy, allowing authenticated attackers to POST `stage=gimmeanotherblog` directly to the signup route and create blogs regardless of the configured policy (even when set to `none` or `user`). This triggers `wpmu_create_blog()` with the attacker's user ID, and WordPress automatically assigns Administrator role on the newly created subsite. The privilege escalation is limited to the new subsite; the attacker's account remains Subscriber-level on the main network site with no network-level admin capabilities.
Affected products
- Automattic Theme My Login up to and including 7.1.15
Timeline
- 2026-09-05: disclosed