{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mailoptin--1.2.78.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mailoptin:mailoptin:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-109515"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MailOptin (\u003c= 1.2.78.6)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["MailOptin"],"content_html":"\u003cp\u003eThe MailOptin plugin for WordPress (versions 1.2.78.6 and below) is vulnerable to a critical privilege escalation flaw. The vulnerability resides in the \u003ccode\u003esubscribe_to_email_list\u003c/code\u003e endpoint, which fails to validate the \u003ccode\u003eoptin_data[form_custom_field_mappings]\u003c/code\u003e parameter. This oversight allows an unauthenticated attacker to inject arbitrary user database column names into the \u003ccode\u003ewp_insert_user()\u003c/code\u003e function. By passing an existing administrator's user ID and a chosen password, an attacker can force an update to an existing account. This mechanism enables complete site compromise without requiring prior authentication, nonce validation, or specific user capabilities. Successful exploitation requires an active WordPress User Registration opt-in form, which is typically exposed in the public page source.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a site running the MailOptin plugin and scans public pages to retrieve the form UUID.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the \u003ccode\u003esubscribe_to_email_list\u003c/code\u003e endpoint without authentication.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious POST request containing the \u003ccode\u003eoptin_data[form_custom_field_mappings]\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eThe input is passed to the \u003ccode\u003esubscribe()\u003c/code\u003e function, bypassing validation checks.\u003c/li\u003e\n\u003cli\u003eThe attacker-supplied mappings override internal configurations, including \u003ccode\u003eID\u003c/code\u003e and \u003ccode\u003euser_pass\u003c/code\u003e fields.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ewp_insert_user()\u003c/code\u003e function is invoked with the injected, attacker-controlled parameters.\u003c/li\u003e\n\u003cli\u003eThe WordPress database record for the targeted user ID is updated with the attacker-provided password.\u003c/li\u003e\n\u003cli\u003eAttacker logs into the WordPress administrative panel using the compromised account credentials.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to full site takeover by granting attackers administrative access to WordPress instances. Given the widespread use of WordPress opt-in and newsletter plugins, this vulnerability affects any site with a publicly visible registration opt-in form configured via the affected versions of MailOptin. Unauthorized administrative access allows for the deployment of backdoors, data exfiltration, and full control over site content and configuration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the MailOptin plugin to a version released after 1.2.78.6 to patch the insecure parameter validation.\u003c/li\u003e\n\u003cli\u003eAudit WordPress user account logs for suspicious password resets or unexpected account updates occurring via the \u003ccode\u003ewp_insert_user\u003c/code\u003e context.\u003c/li\u003e\n\u003cli\u003eDisable public-facing opt-in forms on WordPress installations until the patch is applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:24:40Z","date_published":"2026-10-16T06:24:40Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mailoptin-priv-esc/","summary":"The MailOptin WordPress plugin contains a vulnerability in the subscribe_to_email_list endpoint that allows unauthenticated attackers to overwrite arbitrary user accounts, including administrators, via insecure parameter handling.","title":"Unauthenticated Privilege Escalation in MailOptin WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-mailoptin-priv-esc/"}],"language":"en","title":"CraftedSignal Threat Feed - MailOptin (\u003c= 1.2.78.6)","version":"https://jsonfeed.org/version/1.1"}