{
 "id": "WPSEC-2026-0957",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0957/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0957/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0957/index.md",
 "title": "MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.6 - Unauthenticated Privilege Escalation via Account Takeover through Optin Form Field Mapping Parameter",
 "description": "The MailOptin plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover through the optin form field mapping parameter in all versions up to, and including, 1.2.78.6. This is due to the public subscribe_to_email_list handler passing the submitted 'form_custom_field_mappings' value through as trusted subscription data, and the WordPress User Registration integration using those mappings to build the wp_insert_user() arguments without limiting which user fields can be set. This makes it possible for unauthenticated attackers to supply an 'ID' field, so that an existing account (including an administrator's) is updated instead of a new one being created. The attacker can then overwrite that account's email address and password and take it over. Exploitation requires an optin campaign that uses the WordPress User Registration integration.",
 "plugin": {
  "slug": "mailoptin",
  "name": "MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.",
  "full_name": "MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.",
  "wordpress_org": "https://wordpress.org/plugins/mailoptin/",
  "advisories_url": "https://wpsec.com/vuln/plugin/mailoptin/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/mailoptin"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-915"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.2.78.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.2.78.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.2.78.7",
 "remediation": "Update to 1.2.78.7 or later.",
 "fix_released": "2026-10-13T18:10:15+00:00",
 "published": "2026-10-14T18:47:05+00:00",
 "updated": "2026-10-14T14:17:55.768137+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0957/",
  "https://plugins.svn.wordpress.org/mailoptin/tags/1.2.78.7/",
  "https://wordpress.org/plugins/mailoptin/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/mailoptin",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-14"
 }
}