External risk intelligence

MailOptin WordPress Plugin Privilege Escalation Leading to Full Site Compromise

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-109515

The vulnerability exists in a WordPress plugin that functions as a public-facing opt-in form. Because these forms are designed to be embedded on public web pages to collect visitor data, the vulnerable endpoint is exposed to the internet by design and accessible to unauthenticated users.

Privilege Escalation

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in a popular WordPress plugin used for email subscriptions and form building, affecting all versions. This issue could allow unauthorized individuals to gain control of user accounts, including administrator access, potentially leading to a full website compromise. The primary concern is to determine if this plugin is in use and to what extent it might be exposed.

Website plugin allows unauthorized account takeover.
Critical access could be compromised by external actors.
Confirm if the plugin is active and exposed.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can compromise any WordPress user account, including administrators, by exploiting a flaw in how the MailOptin plugin handles user registration data. This is achieved by sending specially crafted data to a specific endpoint, which tricks the plugin into updating user information, including passwords. This allows the attacker to gain full control of the website.

Requires a published WordPress User Registration opt-in form.
Sends malicious data to the `subscribe_to_email_list` endpoint.
Enables takeover of any user account.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could take over any WordPress user account, including administrators, by manipulating an opt-in form. This is possible when a WordPress User Registration opt-in form is published on the site, allowing the attacker to overwrite user passwords and gain full control of the website.

User account credentials.
Overwriting user passwords via a published form.
Full website compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Plugin owners and web administrators are primarily responsible for addressing this critical vulnerability. The first practical move is to identify all WordPress instances utilizing the MailOptin plugin, determine if any user registration opt-in forms are published, and assess the business criticality of affected sites. This will enable the identification of accountable owners and the planning of remediation, potentially involving vendor coordination or temporary risk reduction measures.

Plugin owners and web administrators should own the issue.
Verify if user registration opt-in forms are published.
Plan remediation based on confirmed exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MailOptin WordPress plugin?

MailOptin is a tool for WordPress sites used to build lead generation forms, popups, and email newsletters. It connects your website to email marketing services like Mailchimp or HubSpot and manages user registration. By integrating these forms directly into your site's layout, the plugin allows you to capture visitor information or register new users seamlessly.

What does CVE-2026-109515 mean in plain English?

This vulnerability is classified as Improper Privilege Management (CWE-269). Essentially, the plugin fails to properly check input data when processing forms. An attacker can manipulate this data to trick the system into updating sensitive user information. By targeting specific fields, they can overwrite existing passwords, allowing them to impersonate any user, including site administrators.

How can an attacker trigger this vulnerability?

An attacker targets the plugin's subscribe endpoint by submitting malicious data designed to modify user records. This only works if a 'WordPress User Registration' opt-in form is currently published and visible on the site. If your site does not use this specific type of registration form, the vulnerable path cannot be reached by an attacker.

Is my website at risk from this CVE?

According to Halo Surface Signal, this vulnerability is considered very likely to be reachable because the plugin’s purpose is to place forms on public-facing web pages. Since these forms are intentionally accessible to internet users, the vulnerable endpoint is exposed by design. If you have any public-facing registration forms enabled, your site is reachable.

What should I do to secure my site?

Start by auditing your WordPress instances to see where the MailOptin plugin is active. Verify whether you have any 'User Registration' opt-in forms published on your pages. If you find these forms, prioritize updating the plugin to a secure version immediately. If an update is not yet available, consider temporarily disabling the registration form functionality to remove the risk.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.