CVE-2026-109515

9.8Critical

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-269

Impact

Unauthenticated attackers can take over any WordPress account, including administrators, leading to full site compromise. They only need network access to a site with an active WordPress User Registration opt-in form published.

Root cause

The `subscribe_to_email_list` endpoint accepts an unvalidated custom field mapping parameter that lets attackers inject arbitrary columns like `ID` and `user_pass` into `wp_insert_user()`.

Affected systems

MailOptin WordPress plugin versions up to and including 1.2.78.6

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade MailOptin to a version newer than 1.2.78.6. As an interim workaround, unpublish or delete any active MailOptin WordPress User Registration opt-in forms, or disable the plugin entirely until patched.

shell

$ wp plugin update mailoptin

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109515