Critical WordPress Plugin Flaw Allows Unauthenticated Account Takeover
A severe privilege escalation in MailOptin lets attackers overwrite any user password, including administrators, without authentication.
Key points
- CVE-2026-109515 is rated CVSS 9.8 Critical by the National Vulnerability Database.
- The flaw affects all versions of the MailOptin plugin up to and including 1.2.78.6.
- Attackers can hijack any WordPress account by exploiting a missing validation check.
The MailOptin WordPress plugin contains a critical security vulnerability that allows unauthenticated attackers to take over any user account on an affected site. According to the National Vulnerability Database, this privilege escalation flaw, tracked as CVE-2026-109515, carries a maximum severity score of 9.8.
The vulnerability exists in all plugin versions up to and including 1.2.78.6. It stems from the `subscribe_to_email_list` endpoint accepting attacker-supplied input without proper allow-list validation. This oversight permits malicious actors to override administrator settings and inject arbitrary data into core WordPress functions.
Technical Analysis of the Vulnerability
The flaw involves the `optin_data[form_custom_field_mappings]` parameter, which fails to validate destination keys. This allows an attacker to map custom fields to sensitive database columns, such as `ID` and `user_pass`. These values are then passed directly into the `wp_insert_user()` function via the plugin’s `subscribe()` method.
By supplying a specific numeric `ID`, an attacker can force the system into update mode for an existing account. They can then overwrite that account’s password with a pre-hashed value of their choosing. This technique enables full takeover of any user profile, including those with administrative privileges, leading to complete site compromise.
Scope and Exploitation Conditions
Exploitation requires that a WordPress User Registration opt-in form is published on the site. However, the form’s UUID is visible in the page source, making it easy for attackers to locate. No authentication, nonce, or capability check is required to reach the vulnerable endpoint, lowering the barrier to entry significantly.
The NVD record classifies the weakness under CWE-269, indicating improper privilege management. Because the attack vector is unauthenticated and impacts the integrity of user credentials, the risk is particularly high for public-facing WordPress installations using this plugin for email marketing or newsletter sign-ups.
What should you do?
Site administrators should immediately verify if the MailOptin plugin is installed and check its version against the affected range. If the plugin is active, users should assess whether any registration forms are publicly accessible. Monitoring server logs for unusual activity related to user creation or password changes is also advisable while awaiting vendor guidance.
What to do and how to stay safe: MailOptin
- Audit your WordPress installation to confirm if MailOptin versions prior to 1.2.78.7 are installed.
- Disable or remove the plugin immediately if you cannot verify a patched version is available.
- Monitor user accounts for unauthorized password resets or unexpected privilege changes.
- Once the vendor provides an update, apply it promptly to restore secure functionality.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of MailOptin are affected by CVE-2026-109515?
All versions up to and including 1.2.78.6 are vulnerable to this privilege escalation flaw.
Do attackers need to be logged in to exploit this vulnerability?
No, the endpoint requires no authentication, nonce, or capability checks to access.
What is the maximum impact of this vulnerability?
Attackers can take over any WordPress user account, including administrators, leading to full site compromise.
