{"id":"CVE-2026-109515","kind":"vulnerability","aliases":["CVE-2026-109515"],"related":[],"title":"The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc","description":"The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.","summary":"The MailOptin WordPress plugin lets an unauthenticated visitor hit its subscribe endpoint with a crafted field mapping that overwrites the password of an existing WordPress user, including administrators. An attacker who takes over an admin account gets full control of the site.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mailoptin","package","self-hosted","wordpress"],"not_affected_if":["no-user-registration-optin-form","plugin-not-installed","version-above-1.2.78.6"],"how_to_check":"Check the installed MailOptin version in the WordPress plugins screen or wp-content/plugins/mailoptin; versions up to and including 1.2.78.6 are affected.\nConfirm whether a WordPress User Registration opt-in form is published on the site.","fix":"Update MailOptin to a version later than 1.2.78.6 (the sources do not name the patched release).\nIf no update is available, deactivate the plugin and reset passwords for administrator accounts.","status":"open","published_at":"2026-10-16T05:17:29+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-23T22:05:12+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:05:12Z","model":"claude-haiku-5-5","output":{"fix":"Update MailOptin to a version later than 1.2.78.6 (the sources do not name the patched release).\nIf no update is available, deactivate the plugin and reset passwords for administrator accounts.","reach":"internet","impact":"high","summary":"The MailOptin WordPress plugin lets an unauthenticated visitor hit its subscribe endpoint with a crafted field mapping that overwrites the password of an existing WordPress user, including administrators. An attacker who takes over an admin account gets full control of the site.","category":"package","who_cares":["wordpress","mailoptin","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker takes over any WordPress account, including administrators, and the site","analyst_note":"Confirm the patched MailOptin version from the plugin changelog or the NVD/Wordfence entry for CVE-2026-109515; the sources here do not name it.","how_to_check":"Check the installed MailOptin version in the WordPress plugins screen or wp-content/plugins/mailoptin; versions up to and including 1.2.78.6 are affected.\nConfirm whether a WordPress User Registration opt-in form is published on the site.\nunknown","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-above-1.2.78.6","no-user-registration-optin-form"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000562,"input_tokens":3082,"output_tokens":508,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-109515':15A,18A '-2026':14A,17A '1.2.78.6':94C 'accept':105C 'account':60B,178C,189C,208C 'admin':59B 'administr':52B,135C,210C 'allow':120C,126C 'allow-list':119C 'arbitrari':141C 'attack':54B,108C,129C,166C 'attacker-control':128C 'attacker-suppli':107C 'authent':245C 'aweb':11A,77C 'capabl':248C 'check':249C 'choos':200C 'column':144C 'compromis':215C 'control':63B,130C 'craft':39B 'custom':113C 'cve':13A,16A 'data':111C 'destin':124C 'direct':151C 'due':97C 'email':6A,72C,102C 'endpoint':36B,104C,256C 'escal':86C 'etc':12A,78C 'exist':48B,177C 'exploit':216C 'field':40B,114C 'forc':168C 'form':5A,71C,112C,226C,235C 'full':62B,213C 'function':159C 'get':61B 'hash':196C 'hit':33B 'host':23B 'hubspot':10A,76C 'id':147C,186C 'includ':51B,93C,146C,209C 'insert':154C,170C 'key':125C 'lead':211C 'let':29B 'list':103C,121C 'mailchimp':9A,75C 'mailoptin':2A,19B,26B,68C 'make':161C 'map':41B,115C,131C,138C 'mode':174C 'name':145C 'newslett':7A,73C 'nonc':246C 'numer':185C 'opt':224C 'opt-in':223C 'optin':4A,70C,110C 'overrid':133C 'overwrit':43B,187C 'packag':20B 'page':241C 'paramet':116C 'pass':140C,150C 'password':45B,191C 'plugin':28B,79C 'popup':3A,69C 'possibl':163C 'pre':195C 'pre-hash':194C 'privileg':85C 'publish':228C 'reach':253C 'registr':222C 'requir':217C,251C 'save':137C 'self':22B 'self-host':21B 'site':66B,214C,232C 'somewher':229C 'sourc':242C 'subscrib':35B,100C,158C 'suppli':109C,180C 'take':56B,203C 'target':182C 'therebi':202C 'though':233C 'unauthent':31B,165C 'updat':173C 'user':50B,143C,149C,155C,171C,183C,207C,221C 'uuid':237C 'valid':122C 'valu':197C 'version':89C 'via':156C 'visibl':239C 'visitor':32B 'vulner':83C,255C 'without':117C 'wordpress':24B,27B,49B,81C,206C,220C 'wp':142C,153C,169C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T05:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109515","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109515","severity":null,"published_at":"2026-10-16T05:17:29+00:00","modified_at":"2026-10-16T15:17:07+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}