# MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. <= 1.2.78.6 - Unauthenticated Privilege Escalation via Account Takeover through Optin Form Field Mapping Parameter

- **ID:** WPSEC-2026-0957
- **Plugin:** MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. (`mailoptin`), https://wordpress.org/plugins/mailoptin/
- **Affected versions:** all versions before 1.2.78.7
- **Fixed in:** 1.2.78.7 (Update to 1.2.78.7 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-915
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/mailoptin
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0957/

## Description

The MailOptin plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover through the optin form field mapping parameter in all versions up to, and including, 1.2.78.6. This is due to the public subscribe_to_email_list handler passing the submitted 'form_custom_field_mappings' value through as trusted subscription data, and the WordPress User Registration integration using those mappings to build the wp_insert_user() arguments without limiting which user fields can be set. This makes it possible for unauthenticated attackers to supply an 'ID' field, so that an existing account (including an administrator's) is updated instead of a new one being created. The attacker can then overwrite that account's email address and password and take it over. Exploitation requires an optin campaign that uses the WordPress User Registration integration.

## References

- https://wpsec.com/vuln/WPSEC-2026-0957/
- https://plugins.svn.wordpress.org/mailoptin/tags/1.2.78.7/
- https://wordpress.org/plugins/mailoptin/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0957/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.