@tomliwpdev You seeing this on WPE? That’s where were seeing it for a client’s site.
Hi all,
Wanted to clarify what this actually is, since “security vulnerability” sounds scarier than it is here, and good news: we’ve already got a fix in.
This is a newly-published CSRF finding (CVE-2026-66681, Patchstack rates it 4.3/10, Low), and the real-world impact is narrow. The worst it can do is get an admin’s browser tricked into unwittingly deactivating (or activating) an extension license. That’s it. It doesn’t break site functionality, doesn’t expose data, and doesn’t give an attacker any real foothold. It just flips a license flag, which in turn pauses auto-updates for that extension until it’s reactivated.
A few other things worth knowing:
Not remotely exploitable. CSRF only works if a logged-in admin is tricked into clicking a malicious link or loading a crafted page/form while logged into the dashboard. An attacker can’t just hit your site directly and trigger it.
Fix is already committed. We’ve pushed a fix adding nonce verification to the two AJAX handlers involved (tml_admin_ajax_activate_extension_license and tml_admin_ajax_deactivate_extension_license), and it’ll be in the next release: https://github.com/theme-my-login/theme-my-login/commit/e6470325c13bab86bd412d14e94a1a24de057cc9. That’s also why WordPress isn’t showing an update yet; we just haven’t cut the release.
Worst case is a license flag, not a compromise. If you ever notice an extension license showing inactive with no explanation, just reactivate it. That’s the whole blast radius here.
In the meantime, standard hygiene applies: be cautious about clicking unfamiliar links while logged into wp-admin. We’ll post here again once the release goes out.
No need to panic on this one. It’s low-impact and already handled.
I wasn’t worry @jfarthing84 I already patched it on my end and was going to reach out to you on Git. But knowing you guys are golden already is great.
I was just going to state to @tomliwpdev that if he/they saw this on WPE to not worry. WPE likes making things seem more alarming than they really are.
@serafinnyc No. WP Engine isn’t flagging it on my end. The issue only appears on Kinsta and in a few plugin management tools.
@jfarthing84
Thanks for the detailed explanation, Jeff. That makes sense.
I understand why there’s no update available yet. I’ll keep an eye on it and wait for the next release so I can test everything once it’s available.
Thanks again!
Ah, thanks @tomliwpdev — We have most of our clients on Kinsta, but no one with this plugin. Only one client left on WPE that uses it.
Also, if you don’t want to wait for @jfarthing84 release I patched it already on my end and I put it on my github page. Take care.
@jfarthing84 – Thanks for the quick update Jeff truly appreciate it!
Just an FYI on this, it is not a “new” report. It was reported July 6, 30 days ago, and was published to Patchstack on Aug 6. While the issue may be a low priority, and may not be easily exploited, more than 30 days to patch in the current landscape makes it concerning for when there is a severe issue.
