Privilege Escalation via Account Takeover in Theme My Login Multisite Password Handling
On WordPress multisite installs where Theme My Login lets users choose their own password, the plugin wrote the submitted user_pass1 value into the password of whichever user record WordPress was saving, on inserts and updates alike. An unauthenticated attacker can therefore overwrite the password of an existing account, including an administrator, and take it over.
This vulnerability affects the following application versions:
- Theme My Login 7.0
- Theme My Login 7.0.1
- Theme My Login 7.0.2
- Theme My Login 7.0.3
- Theme My Login 7.0.4
- Theme My Login 7.0.5
- Theme My Login 7.0.6
- Theme My Login 7.0.7
- Theme My Login 7.0.8
- Theme My Login 7.0.9
- Theme My Login 7.0.10
- Theme My Login 7.0.11
- Theme My Login 7.0.12
- Theme My Login 7.0.13
- Theme My Login 7.0.14
- Theme My Login 7.0.15
- Theme My Login 7.1
- Theme My Login 7.1.1
- Theme My Login 7.1.2
- Theme My Login 7.1.3
- Theme My Login 7.1.4
- Theme My Login 7.1.5
- Theme My Login 7.1.6
- Theme My Login 7.1.7
- Theme My Login 7.1.8
- Theme My Login 7.1.9
- Theme My Login 7.1.10
- Theme My Login 7.1.11
- Theme My Login 7.1.12
- Theme My Login 7.1.13
- Theme My Login 7.1.14
- Theme My Login 7.1.15
- Theme My Login 7.2.0
- Theme My Login 7.2.1