CVE-2026-109515

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the subscribe_to_email_list endpoint accepting an attacker-supplied optin_data[form_custom_field_mappings] parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary wp_users column names — including ID and user_pass — directly into wp_insert_user() via the subscribe() function. This makes it possible for unauthenticated attackers to force wp_insert_user() into UPDATE mode on any existing account by supplying a target user's numeric ID, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the subscribe_to_email_list endpoint accepting an attacker-supplied optin_data[form_custom_field_mappings] parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary wp_users column names — including ID and user_pass — directly into wp_insert_user() via the subscribe() function. This makes it possible for unauthenticated attackers to force wp_insert_user() into UPDATE mode on any existing account by supplying a target user's numeric ID, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the subscribe_to_email_list endpoint accepting an attacker-supplied optin_data[form_custom_field_mappings] parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary wp_users column names — including ID and user_pass — directly into wp_insert_user() via the subscribe() function. This makes it possible for unauthenticated attackers to force wp_insert_user() into UPDATE mode on any existing account by supplying a target user's numeric ID, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the subscribe_to_email_list endpoint accepting an attacker-supplied optin_data[form_custom_field_mappings] parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary wp_users column names — including ID and user_pass — directly into wp_insert_user() via the subscribe() function. This makes it possible for unauthenticated attackers to force wp_insert_user() into UPDATE mode on any existing account by supplying a target user's numeric ID, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account — including administrators — leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.