Title: Theme My Login security issue Last modified: August 6, 2026 --- # Theme My Login security issue * [tomliwpdev](https://wordpress.org/support/users/tomliwpdev/) * (@tomliwpdev) * [2 days, 2 hours ago](https://wordpress.org/support/topic/theme-my-login-security-issue/) * Hello, * I’m seeing a security warning for the **Theme My Login** plugin related to the following vulnerability: * [https://patchstack.com/database/wordpress/plugin/theme-my-login/vulnerability/wordpress-theme-my-login-plugin-7-1-14-cross-site-request-forgery-csrf-vulnerability](https://patchstack.com/database/wordpress/plugin/theme-my-login/vulnerability/wordpress-theme-my-login-plugin-7-1-14-cross-site-request-forgery-csrf-vulnerability) * However, WordPress is not offering any plugin update, and my installation appears to already be on the latest version available. * Could you please check why the update is not being detected? Is this a false positive from the vulnerability scanner, or is there another update that hasn’t been made available yet? * Thank you. Viewing 7 replies - 1 through 7 (of 7 total) * [Stef](https://wordpress.org/support/users/serafinnyc/) * (@serafinnyc) * [2 days ago](https://wordpress.org/support/topic/theme-my-login-security-issue/#post-18986377) * [@tomliwpdev](https://wordpress.org/support/users/tomliwpdev/) You seeing this on WPE? That’s where were seeing it for a client’s site. * Plugin Author [Jeff Farthing](https://wordpress.org/support/users/jfarthing84/) * (@jfarthing84) * [2 days ago](https://wordpress.org/support/topic/theme-my-login-security-issue/#post-18986379) * Hi all, * Wanted to clarify what this actually is, since “security vulnerability” sounds scarier than it is here, and good news: we’ve already got a fix in. * This is a newly-published CSRF finding (CVE-2026-66681, Patchstack rates it 4.3/ 10, Low), and the real-world impact is narrow. The worst it can do is get an admin’s browser tricked into unwittingly deactivating (or activating) an extension license. That’s it. It doesn’t break site functionality, doesn’t expose data, and doesn’t give an attacker any real foothold. It just flips a license flag, which in turn pauses auto-updates for that extension until it’s reactivated. * A few other things worth knowing: * Not remotely exploitable. CSRF only works if a logged-in admin is tricked into clicking a malicious link or loading a crafted page/form while logged into the dashboard. An attacker can’t just hit your site directly and trigger it. * Fix is already committed. We’ve pushed a fix adding nonce verification to the two AJAX handlers involved (tml_admin_ajax_activate_extension_license and tml_admin_ajax_deactivate_extension_license), and it’ll be in the next release: [https://github.com/theme-my-login/theme-my-login/commit/e6470325c13bab86bd412d14e94a1a24de057cc9](https://github.com/theme-my-login/theme-my-login/commit/e6470325c13bab86bd412d14e94a1a24de057cc9). That’s also why WordPress isn’t showing an update yet; we just haven’t cut the release. * Worst case is a license flag, not a compromise. If you ever notice an extension license showing inactive with no explanation, just reactivate it. That’s the whole blast radius here. * In the meantime, standard hygiene applies: be cautious about clicking unfamiliar links while logged into wp-admin. We’ll post here again once the release goes out. * No need to panic on this one. It’s low-impact and already handled. * [Stef](https://wordpress.org/support/users/serafinnyc/) * (@serafinnyc) * [1 day, 23 hours ago](https://wordpress.org/support/topic/theme-my-login-security-issue/#post-18986416) * I wasn’t worry [@jfarthing84](https://wordpress.org/support/users/jfarthing84/) I already patched it on my end and was going to reach out to you on Git. But knowing you guys are golden already is great. * I was just going to state to [@tomliwpdev](https://wordpress.org/support/users/tomliwpdev/) that if he/they saw this on WPE to not worry. WPE likes making things seem more alarming than they really are. * Thread Starter [tomliwpdev](https://wordpress.org/support/users/tomliwpdev/) * (@tomliwpdev) * [1 day, 8 hours ago](https://wordpress.org/support/topic/theme-my-login-security-issue/#post-18987168) * [@serafinnyc](https://wordpress.org/support/users/serafinnyc/) No. WP Engine isn’t flagging it on my end. The issue only appears on Kinsta and in a few plugin management tools. [@jfarthing84](https://wordpress.org/support/users/jfarthing84/) Thanks for the detailed explanation, Jeff. That makes sense. * I understand why there’s no update available yet. I’ll keep an eye on it and wait for the next release so I can test everything once it’s available. * Thanks again! * [Stef](https://wordpress.org/support/users/serafinnyc/) * (@serafinnyc) * [1 day, 8 hours ago](https://wordpress.org/support/topic/theme-my-login-security-issue/#post-18987172) * Ah, thanks [@tomliwpdev](https://wordpress.org/support/users/tomliwpdev/) — We have most of our clients on Kinsta, but no one with this plugin. Only one client left on WPE that uses it. * Also, if you don’t want to wait for [@jfarthing84](https://wordpress.org/support/users/jfarthing84/) release I patched it already on my end and I put it on my [github](https://github.com/StefsterNYC/theme-my-login-csrf-patch) page. Take care. * [willnev](https://wordpress.org/support/users/willnev/) * (@willnev) * [1 day, 6 hours ago](https://wordpress.org/support/topic/theme-my-login-security-issue/#post-18987305) * [@jfarthing84](https://wordpress.org/support/users/jfarthing84/) – Thanks for the quick update Jeff truly appreciate it! * [7thcircle](https://wordpress.org/support/users/7thcircle/) * (@7thcircle) * [20 hours, 36 minutes ago](https://wordpress.org/support/topic/theme-my-login-security-issue/#post-18987701) * Just an FYI on this, it is not a “new” report. It was reported July 6, 30 days ago, and was published to Patchstack on Aug 6. While the issue may be a low priority, and may not be easily exploited, more than 30 days to patch in the current landscape makes it concerning for when there is a severe issue. Viewing 7 replies - 1 through 7 (of 7 total) You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Ftheme-my-login-security-issue%2F%3Foutput_format%3Dmd&locale=en_US) to reply to this topic. * ![](https://ps.w.org/theme-my-login/assets/icon-256x256.png?rev=1891232) * [Theme My Login](https://wordpress.org/plugins/theme-my-login/) * [Frequently Asked Questions](https://wordpress.org/plugins/theme-my-login/#faq) * [Support Threads](https://wordpress.org/support/plugin/theme-my-login/) * [Active Topics](https://wordpress.org/support/plugin/theme-my-login/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/theme-my-login/unresolved/) * [Reviews](https://wordpress.org/support/plugin/theme-my-login/reviews/) * 8 replies * 5 participants * Last reply from: [7thcircle](https://wordpress.org/support/users/7thcircle/) * Last activity: [20 hours, 36 minutes ago](https://wordpress.org/support/topic/theme-my-login-security-issue/#post-18987701) * Status: not a support question