MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.6 - Unauthenticated Privilege Escalation via Account Takeover through Optin Form Field Mapping Parameter
- ID
- WPSEC-2026-0957
- Plugin
- MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. (mailoptin)
- Affected
- all versions before 1.2.78.7
- Remediation
- Update to 1.2.78.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-915
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. on WPSec AttackSurface
- Fix released
- Published
Description
The MailOptin plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover through the optin form field mapping parameter in all versions up to, and including, 1.2.78.6. This is due to the public subscribe_to_email_list handler passing the submitted 'form_custom_field_mappings' value through as trusted subscription data, and the WordPress User Registration integration using those mappings to build the wp_insert_user() arguments without limiting which user fields can be set. This makes it possible for unauthenticated attackers to supply an 'ID' field, so that an existing account (including an administrator's) is updated instead of a new one being created. The attacker can then overwrite that account's email address and password and take it over. Exploitation requires an optin campaign that uses the WordPress User Registration integration.
References
- https://wpsec.com/vuln/WPSEC-2026-0957/
- https://plugins.svn.wordpress.org/mailoptin/tags/1.2.78.7/
- https://wordpress.org/plugins/mailoptin/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS