The Optional Email plugin for WordPress is vulnerable because its 'random_password' filter is applied outside of registration contexts, creating a CWE-639 weakness that allows an unauthenticated attacker to set a known password reset key when initiating a password reset. By doing so, the attacker effectively bypasses authorization checks and can reset the password for any user, including administrators, achieving full account takeover.

Any WordPress site that has the Optional Email plugin version 1.3.11 or earlier installed. The flaw exists in all releases up to and including 1.3.11 and removes the restriction on the password‑reset process for those versions.

The flaw carries a CVSS score of 9.8, indicating critical severity, but its EPSS score of <1% indicates that widespread exploitation is unlikely under current conditions. It is not listed in CISA’s KEV catalog. Exploitation is possible by an unauthenticated attacker visiting the public password‑reset page, selecting a pre‑known key, and resetting a target user’s password. Once the password is changed, the attacker can log in to any account, including those with administrative privileges.