The MailOptin plugin is vulnerable because its subscribe_to_email_list endpoint accepts a user‑supplied form_custom_field_mappings array without restricting the destination keys. An attacker can set keys that match wp_users columns, such as ID and user_pass, and through wp_insert_user() force an UPDATE on an existing account. The attacker supplies a target user’s numeric ID and a pre‑hashed password, thus changing that account’s credentials. The vulnerability allows a remote, unauthenticated actor to take ownership of any WordPress user, including administrators, leading to full site compromise.

All installations of the MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. WordPress plugin up to version 1.2.78.6. Any WordPress site that exposes the User Registration opt‑in form is affected, because the form’s UUID is publicly visible and the vulnerable endpoint has no authentication, nonce or capability checks.

The CVSS score of 9.8 classifies this as critical, indicating severe impact, high exploitability, and the need for immediate mitigation. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the endpoint is reachable without authentication and the form UUID is in page source, the likely attack vector is a network request from any internet‑connected attacker. Successful exploitation grants an attacker the ability to alter any user’s password and assume administrative privileges, which is a full compromise of the affected WordPress site.