CVE-2026-109515: CWE-269 Improper Privilege Management in properfraction MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
Description
The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.
CVSS v3.1
Score 9.8critical
Affected software
properfraction
MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109515 describes a privilege escalation vulnerability in the MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. WordPress plugin. The vulnerability arises because the subscribe_to_email_list endpoint accepts an attacker-controlled optin_data[form_custom_field_mappings] parameter without allow-list validation on destination keys. This enables attackers to override administrator mappings and supply arbitrary wp_users column names, including ID and user_pass, to the wp_insert_user() function. By supplying a target user's numeric ID and a pre-hashed password, attackers can force wp_insert_user() into update mode, resetting the password of any WordPress user account, including administrators, leading to full site compromise. Exploitation requires a published WordPress User Registration opt-in form, but no authentication or capability checks are required to reach the vulnerable endpoint.
Potential Impact
Successful exploitation allows unauthenticated attackers to take over any WordPress user account, including administrators, by resetting passwords. This leads to full site compromise with complete control over the affected WordPress installation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or remove publicly accessible WordPress User Registration opt-in forms to reduce exposure. Monitor vendor channels for updates and apply patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-10-12T18:05:34.654Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad1acbd2cdf04f656b600ef
Added to database: 10/16/2026, 04:49:01 UTC
Last enriched: 10/16/2026, 05:03:30 UTC
Last updated: 10/16/2026, 19:03:29 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.