Unauthenticated Privilege Escalation in MailOptin WordPress Plugin

The MailOptin plugin for WordPress (versions 1.2.78.6 and below) is vulnerable to a critical privilege escalation flaw. The vulnerability resides in the subscribe_to_email_list endpoint, which fails to validate the optin_data[form_custom_field_mappings] parameter. This oversight allows an unauthenticated attacker to inject arbitrary user database column names into the wp_insert_user() function. By passing an existing administrator's user ID and a chosen password, an attacker can force an update to an existing account. This mechanism enables complete site compromise without requiring prior authentication, nonce validation, or specific user capabilities. Successful exploitation requires an active WordPress User Registration opt-in form, which is typically exposed in the public page source.

Attack Chain

1. Attacker identifies a site running the MailOptin plugin and scans public pages to retrieve the form UUID.
2. Attacker interacts with the subscribe_to_email_list endpoint without authentication.
3. Attacker crafts a malicious POST request containing the optin_data[form_custom_field_mappings] parameter.
4. The input is passed to the subscribe() function, bypassing validation checks.
5. The attacker-supplied mappings override internal configurations, including ID and user_pass fields.
6. The wp_insert_user() function is invoked with the injected, attacker-controlled parameters.
7. The WordPress database record for the targeted user ID is updated with the attacker-provided password.
8. Attacker logs into the WordPress administrative panel using the compromised account credentials.

Impact

Successful exploitation leads to full site takeover by granting attackers administrative access to WordPress instances. Given the widespread use of WordPress opt-in and newsletter plugins, this vulnerability affects any site with a publicly visible registration opt-in form configured via the affected versions of MailOptin. Unauthorized administrative access allows for the deployment of backdoors, data exfiltration, and full control over site content and configuration.

Recommendation

• Immediately update the MailOptin plugin to a version released after 1.2.78.6 to patch the insecure parameter validation.
• Audit WordPress user account logs for suspicious password resets or unexpected account updates occurring via the wp_insert_user context.
• Disable public-facing opt-in forms on WordPress installations until the patch is applied.