Privilege Escalation Vulnerability in MailOptin Plugin for WordPress

CVE-2026-109515

What is CVE-2026-109515?

The MailOptin plugin for WordPress is susceptible to a privilege escalation vulnerability that allows unauthenticated attackers to manipulate the subscribe_to_email_list endpoint. This endpoint accepts user-provided mappings without validating the destination keys, making it possible for attackers to overwrite user details, including passwords. By exploiting this flaw, an attacker could take control of any existing WordPress account, including those with administrative privileges. This vulnerability requires the presence of a WordPress User Registration opt-in form on the site, but the form’s UUID is exposed in the page source, allowing easy access to the endpoint without any authentication checks.

References