CVE-2026-89079

{
  "etk_id": "ETK-2026-1754",
  "cve_id": "CVE-2026-89079",
  "display_id": "CVE-2026-89079",
  "ghsa_id": "GHSA-v32q-5f5q-9x8f",
  "euvd_id": "EUVD-2026-102666",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper identity validation in Theme My Login password changes",
  "summary": "Theme My Login 7.2.1 and earlier can inadequately verify account ownership during password changes on WordPress multisite sites using certain configurations. An unauthenticated remote attacker may take over another user’s account and obtain that account’s privileges.",
  "mitigation": "Upgrade Theme My Login to a release newer than 7.2.1 after confirming it addresses this issue. Until then, deactivate the plugin on affected multisite installations to reduce exposure.",
  "vendor": "jfarthing84",
  "product": "Theme My Login",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 7.2.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Theme My Login",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0029,
  "epss_percentile": 0.2066,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 53.38974951666667,
  "t0_at": "2026-10-16T05:30:22.643000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-16T08:10:07.981393+00:00",
      "days": 0.11094141658564814,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T05:30:22.643000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-10-15T00:00:00+00:00",
      "days": -1,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T05:30:22.643000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-89079"
    },
    "public_poc": {
      "at": "2026-10-16T11:44:49+00:00",
      "days": 0.26002728009259257,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T05:30:22.643000+00:00",
      "url": "https://github.com/murrez/CVE-2026-89079"
    },
    "trigger_signal": {
      "at": "2026-10-16T05:30:22.643000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T05:30:22.643000+00:00",
      "url": "https://github.com/advisories/GHSA-v32q-5f5q-9x8f"
    }
  }
}