MailOptin EUVD-2026-102644

Exploitation requires that a MailOptin 'WordPress User Registration' connection opt-in form is published somewhere on the target site; the attacker reads the form's UUID directly from the page source. Given that, the subscribe_to_email_list endpoint requires no authentication, nonce, or capability check, and the subscribe() path passes attacker-controlled optin_data[form_custom_field_mappings] keys (including ID and user_pass) straight into wp_insert_user() with no destination-key allow-list. The sole limiting factor is the presence of that published User Registration form - sites using MailOptin only for mailing-list/popup optins without the user-registration connection are not exploitable. No user interaction, privileges, or non-default server settings are otherwise needed.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, 9.8) is fully consistent with the description: an unauthenticated, network-reachable endpoint (subscribe_to_email_list) with no nonce or capability check lets an attacker coerce wp_insert_user() into UPDATE mode and overwrite any account's password, including administrators, yielding full site compromise. All severity signals align rather than conflict - the technical impact is total (admin account takeover), exploitation is automatable, and no authentication is required. The one mitigating factor the raw CVSS does not capture is that a published WordPress User Registration opt-in form must exist on the target site, so exploitability is conditional on site configuration rather than universal across all MailOptin installs. No EPSS score, KEV listing, or public POC was provided in the input, so real-world exploitation volume cannot be quantified; this rating rests on the vendor-confirmed technical analysis (Wordfence) and source-code references, not on observed attacks.

An unauthenticated attacker locates a site running MailOptin with a published WordPress User Registration opt-in form, extracts the form UUID from the page source, and submits a crafted subscribe_to_email_list request whose optin_data[form_custom_field_mappings] maps attacker input to the wp_users ID and user_pass columns. By supplying an administrator's numeric ID and a pre-computed password hash, the request forces wp_insert_user() to update that admin account, handing the attacker working credentials. No public exploit code was identified at time of analysis, but the vulnerable code paths are documented in the referenced plugin source.