Description

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-16T05:17:29.597Z",
  "pubdate": "2026-10-16T05:17:29.597Z",
  "executiveSummary": "The MailOptin plugin for WordPress, in versions up to and including 1.2.78.6, contains a critical privilege escalation vulnerability. The vulnerability stems from improper input validation within the subscribe_to_email_list endpoint, which allows unauthenticated attackers to supply arbitrary user data mappings. By manipulating the optin_data[form_custom_field_mappings] parameter, an attacker can pass unauthorized data directly to the wp_insert_user() function.\nThis flaw permits an attacker to perform unauthorized account takeovers by forcing the application into an update mode for existing user accounts. By specifying the ID of a target user, such as an administrator, and providing a new, attacker-controlled password, the vulnerability facilitates full site compromise. Exploitation is possible without any authentication, provided a WordPress User Registration opt-in form is active on the site. Given the ease of obtaining necessary form identifiers from the page source, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of affected WordPress installations.",
  "technicalDetails": "The vulnerability originates in the subscribe_to_email_list endpoint, which fails to implement a secure allow-list for the optin_data[form_custom_field_mappings] parameter. This parameter is designed to map form fields to user meta or database columns. However, the plugin performs insufficient validation on the destination keys provided in the user-supplied mapping, effectively allowing the injection of arbitrary columns into the underlying database operations.\nThe core of the issue lies in the downstream consumption of these mappings by the subscribe() function. This function passes the improperly validated user-supplied mapping array directly into the wp_insert_user() WordPress function. Because wp_insert_user() dynamically handles user object updates when an 'ID' key is present, an attacker can manipulate the request to target an existing user account rather than creating a new one.\nThe attack flow proceeds as follows: First, an attacker identifies a publicly accessible page containing a MailOptin User Registration opt-in form. The attacker extracts the necessary form UUID from the page source. Second, the attacker crafts a malicious HTTP POST request targeting the subscribe_to_email_list endpoint. Within this request, the attacker populates the optin_data[form_custom_field_mappings] array with key-value pairs that map attacker-supplied form inputs to sensitive wp_users columns, specifically ID and user_pass.\nBy setting the ID parameter to the integer value representing an administrator account and providing a corresponding password, the attacker triggers an update to the administrator's profile. Since wp_insert_user() uses the provided data to overwrite existing record values, the administrator's password is replaced with the attacker's chosen value. This bypasses all authentication mechanisms as the attacker can subsequently log in with the administrator's credentials.\nThe vulnerability is characterized by a complete lack of authentication, nonce verification, or capability checks on the vulnerable endpoint. The attack surface is limited only by the requirement that a user registration form must be enabled within the MailOptin plugin configuration. Post-exploitation, the attacker gains full administrative access to the WordPress environment, allowing for further payload deployment, data exfiltration, or complete system takeover."
}