CVE-2026-109515

9.8 CRITICAL

Published 2026-10-16 · Updated 2026-10-16

AI risk analysis

Summary: The MailOptin WordPress plugin has a privilege escalation vulnerability where unauthenticated attackers can manipulate user account details by directly injecting arbitrary database column names into wp_insert_user() function. This allows attackers to overwrite any user's password and take over their account, including administrator accounts.
Exploitability: Exploitation is straightforward requiring only a published registration form with its UUID visible in page source, no authentication or validation required to reach the vulnerable endpoint, making it highly exploitable with minimal effort.
Blast radius: The vulnerability can lead to complete site compromise as attackers can takeover any WordPress user account including administrators, potentially allowing full control over the entire website and its data.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to version 1.2.78.7 or later to fix this privilege escalation vulnerability.

privilege-escalationwordpressuser-account

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-269

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.