CVE-2026-109515 is a critical (CVSS 9.8) privilege escalation flaw in the MailOptin WordPress plugin, through version 1.2.78.6. On sites that have a published WordPress User Registration opt-in form, it can let unauthenticated attackers overwrite the passwords of existing users, including administrators.
What Is It
The bug sits in MailOptin's subscribe_to_email_list endpoint. The endpoint accepts an attacker-supplied optin_data[form_custom_field_mappings] parameter and never checks the destination keys against an allow-list. That attacker-controlled mapping overrides the administrator's saved mapping. Arbitrary wp_users column names, including ID and user_pass, then pass straight into wp_insert_user() through the plugin's subscribe() function.
If an attacker supplies a target user's numeric ID, wp_insert_user() switches to UPDATE mode on that existing account. The attacker can then replace the account's password with a pre-hashed value of their choosing. Wordfence reported the flaw, and it is classified as CWE-269 (Improper Privilege Management).
Why It Matters
- No authentication required. The vulnerable endpoint has no authentication, nonce, or capability check.
- Potential site compromise. On sites that meet the precondition, an attacker who knows a target's user ID could take over that WordPress account. If the target is an administrator, that could lead to full control of the site.
- Low barrier. Exploitation needs a published WordPress User Registration opt-in form somewhere on the site. The form's UUID is visible in the page source.
- Severity. CVSS 3.1 base score is 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): network-reachable, low complexity, no privileges or user interaction needed, and high impact to confidentiality, integrity, and availability.
No CISA KEV entry was supplied for this CVE, so active exploitation is not confirmed by KEV at this time.
What's Vulnerable
- Vendor: properfraction
- Product: MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. (WordPress plugin)
- Affected versions: all versions up to and including 1.2.78.6
- Precondition: a published WordPress User Registration opt-in form on the site
Patch Status
The NVD record lists every version through 1.2.78.6 as affected. It references a WordPress plugin repository changeset (3744644) to the plugin trunk that modifies the vulnerable Subscription.php file. The record does not name a specific fixed release. The NVD entry is in "Received" status as of its October 16, 2026 publication.
Site owners running MailOptin should update to a release later than 1.2.78.6 once the vendor confirms the fix. Until then, they should check whether any WordPress User Registration opt-in forms are published. Because no KEV entry exists, there is no CISA-mandated required action or due date.