MailOptin CVE-2026-66703

Exploitation requires a valid WordPress Contributor-level account on the target installation; the CVSS PR:L metric confirms this authenticated prerequisite. User interaction is required (UI:R) - a higher-privileged user, typically an administrator, must view or review the content containing the injected payload for execution to occur. No special server-side configuration or non-default plugin settings are indicated as additional prerequisites; the flaw appears to exist in standard MailOptin content-handling functionality. Exploitation is constrained to multi-user WordPress sites where the Contributor role is assigned to potentially untrusted individuals. Sites where all users are fully trusted employees or where contributor registration is closed face negligible practical risk despite the network-accessible attack vector.

The CVSS 6.5 Medium score is driven by AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The PR:L requirement is the primary limiting factor - an attacker must hold a valid Contributor account, which restricts opportunistic mass exploitation. However, the scope change (S:C) elevates real-world impact significantly: successful exploitation targets administrator browser sessions, potentially enabling session hijacking or unauthorized privileged actions. No EPSS score was provided in the source intelligence, and the vulnerability does not appear in CISA KEV, suggesting no confirmed active exploitation at this time. The original CVSS assigns A:L (low availability), which is atypical for XSS and may reflect client-side browser disruption rather than server availability; this analysis treats it as a minor anomaly rather than a confirmed server-impact signal. Real-world risk is highest for WordPress sites with open contributor registration or externally-granted Contributor roles - single-author or fully trusted-user sites face negligible practical risk.

An attacker who registers or compromises a Contributor account on a WordPress site running MailOptin ≤ 1.2.78.0 crafts a MailOptin-related input field or post content containing a malicious JavaScript payload and submits it through the normal contributor workflow. When a site administrator opens the pending content for review or views a page where the payload renders, the script executes silently in the administrator's browser - enabling session cookie theft, unauthorized administrative actions such as creating backdoor accounts, or redirection to phishing infrastructure.