CVE-2026-109515: MailOptin WordPress Plugin Privilege Escalation

CVE-2026-109515 Overview

CVE-2026-109515 is a privilege escalation vulnerability in the MailOptin WordPress plugin affecting all versions up to and including 1.2.78.6. The subscribe_to_email_list AJAX endpoint accepts an attacker-controlled optin_data[form_custom_field_mappings] parameter without allow-list validation. This lets unauthenticated attackers inject arbitrary wp_users column names, including ID and user_pass, directly into wp_insert_user(). By supplying a target user's numeric ID, attackers force wp_insert_user() into UPDATE mode and overwrite the account password with a pre-hashed value they control. The result is full takeover of any account, including administrators, leading to complete site compromise. [CWE-269: Improper Privilege Management]

Critical Impact
Unauthenticated attackers can reset the password of any WordPress user, including administrators, and achieve full site compromise.

Affected Products

MailOptin Plugin for WordPress (Popup, Optin Forms & Email Newsletters)
All versions up to and including 1.2.78.6
Sites running a published WordPress User Registration opt-in form

Discovery Timeline

2026-10-16 - CVE-2026-109515 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-109515

Vulnerability Analysis

The flaw lives in the MailOptin WordPressUserRegistrationConnect subscription workflow. When a visitor submits an opt-in form, the plugin invokes the subscribe_to_email_list AJAX action handled in AjaxHandler.php. That handler forwards the request to the subscribe() function in Subscription.php, which merges the administrator's stored field mappings with values pulled from the incoming optin_data[form_custom_field_mappings] request parameter.

Because the plugin trusts the attacker-supplied mapping, arbitrary destination keys reach wp_insert_user(). Supplying ID with the numeric identifier of an existing user switches wp_insert_user() from create mode to UPDATE mode. Supplying user_pass with a pre-computed PHPass hash overwrites that account's stored password hash directly, bypassing the normal registration flow.

Reaching the vulnerable endpoint requires no authentication, no nonce, and no capability check. The only prerequisite is that a WordPress User Registration opt-in form is published somewhere on the site, and the form's UUID is readable from the page source.

Root Cause

The root cause is missing allow-list validation on destination keys in the field-mapping handler. The plugin treats attacker-controlled mapping entries as equivalent to administrator-saved mappings, which lets sensitive wp_users columns such as ID and user_pass flow into wp_insert_user() unchecked.

Attack Vector

An unauthenticated attacker retrieves the opt-in form UUID from public page source, then issues a crafted POST request to the subscribe_to_email_list endpoint. The request supplies optin_data[form_custom_field_mappings] entries that map input fields to ID and user_pass. The attacker sets ID to a target administrator's user ID and user_pass to a hash of a password they know. After the request completes, the attacker authenticates as that administrator and takes full control of the site.

See the MailOptin Subscription.php code review and the AjaxHandler.php code review for the vulnerable code paths.

Detection Methods for CVE-2026-109515

Indicators of Compromise

POST requests to admin-ajax.php with action=subscribe_to_email_list containing optin_data[form_custom_field_mappings] keys referencing ID or user_pass.
Unexpected password changes on administrator accounts without a corresponding user-initiated reset in audit logs.
Administrator logins from new IP addresses or user agents shortly after suspicious opt-in submissions.
Creation of new administrator accounts or role elevations following traffic to opt-in form endpoints.

Detection Strategies

Inspect web server logs for POSTs to admin-ajax.php where the request body contains form_custom_field_mappings paired with wp_users column names.
Correlate wp_users table UPDATE events against application activity to identify password hash changes with no matching WordPress reset flow.
Alert on authentication success for privileged accounts immediately following unauthenticated requests to the MailOptin opt-in endpoint from the same source.

Monitoring Recommendations

Enable WordPress audit logging for user_register, profile_update, and administrator session events.
Forward WordPress and web server logs to a centralized analytics platform for cross-source correlation and retention.
Monitor the installed MailOptin plugin version across hosted WordPress sites and flag any instance at or below 1.2.78.6.

How to Mitigate CVE-2026-109515

Immediate Actions Required

Update MailOptin to a version later than 1.2.78.6 that includes the fix from WordPress changeset 3744644.
Audit all administrator and privileged accounts for unexpected password changes and force a password reset for every privileged user.
Review recently created WordPress accounts and remove any unauthorized administrator or editor roles.
Rotate WordPress secret keys and salts in wp-config.php to invalidate active sessions.

Patch Information

The vendor addressed the issue by restricting destination keys allowed in the field mapping. Review the fix in WordPress changeset 3744644 and the changeset comparison. Additional analysis is available in the Wordfence vulnerability record.

Workarounds

Unpublish or disable any WordPress User Registration opt-in forms until the plugin is updated.
Deactivate the MailOptin plugin on sites that cannot be patched immediately.
Block requests to admin-ajax.php with action=subscribe_to_email_list carrying form_custom_field_mappings keys of ID or user_pass at the web application firewall.

bash

# Example WAF rule concept to block exploitation attempts
# ModSecurity rule - block mapping overrides to sensitive wp_users columns
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,id:1092026109515,phase:2,deny,status:403,\
     msg:'CVE-2026-109515 MailOptin privilege escalation attempt'"
  SecRule ARGS "@rx action=subscribe_to_email_list" "chain"
    SecRule ARGS_NAMES|ARGS "@rx form_custom_field_mappings.*(ID|user_pass)"