---
id: "CVE-2026-109515"
kind: "vulnerability"
aliases: ["CVE-2026-109515"]
title: "The MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mailoptin", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-user-registration-optin-form", "plugin-not-installed", "version-above-1.2.78.6"]
published_at: "2026-10-16T05:17:29+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-23T22:28:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109515", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc

The MailOptin WordPress plugin lets an unauthenticated visitor hit its subscribe endpoint with a crafted field mapping that overwrites the password of an existing WordPress user, including administrators. An attacker who takes over an admin account gets full control of the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed MailOptin version in the WordPress plugins screen or wp-content/plugins/mailoptin; versions up to and including 1.2.78.6 are affected.
Confirm whether a WordPress User Registration opt-in form is published on the site.

## Fix

Update MailOptin to a version later than 1.2.78.6 (the sources do not name the patched release).
If no update is available, deactivate the plugin and reset passwords for administrator accounts.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109515

## From the sources

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_