CVE-2026-81583
Received Received - Intake

My Login WordPress Plugin Multisite Administrator Privilege Escalation

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: WPScan

Description
The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-81583
EUVD
EUVD-2026-69857

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
my_login my_login to 7.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The My Login WordPress plugin before version 7.2.0 has a flaw where it does not enforce network registration settings during site signups on multisite installations. This allows users with a subscriber account or even unauthenticated users on some networks to create new sites and gain administrator privileges over them.

Detection Guidance

Check the installed version of the My Login plugin. If it is between 7.0 and 7.1.15, the system is vulnerable. Run: wp plugin list | grep my_login to verify the version.

Impact Analysis

This vulnerability could allow unauthorized users to create new sites on a multisite WordPress network and take full administrative control over those sites. This could lead to site defacement, data theft, or further compromise of the entire network.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized users to create new sites and gain administrator privileges. Unauthorized site creation may lead to improper data access, processing, or storage, violating GDPR's data protection principles or HIPAA's access controls and integrity requirements.

Mitigation Strategies

Update the My Login plugin to version 7.2.0 or later immediately. Disable multisite functionality if not required or enforce strict registration settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81583. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart