CVE-2026-57813
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
The MailOptin WordPress plugin contains an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 1.2.77.3 inclusive.
Risk Assessment
An attacker can exploit this vulnerability to gain elevated privileges in the system, potentially leading to full control over the WordPress site and access to sensitive data.
Recommendation
Immediately update the MailOptin plugin to the latest available version that fixes this vulnerability. If no update is available, consider temporarily disabling the plugin.
Other vulnerabilities in MailOptin
See all- CVE-2026-109515Critical
The MailOptin plugin for WordPress (versions up to and including 1.2.78.6) is vulnerable to privilege escalation. The subscribe_to_email_list endpoint accepts the optin_data[form_custom_field_mappings] parameter without validation, allowing an attacker to override the administrator's mapping and pass arbitrary wp_users columns (including ID and user_pass) to wp_insert_user().
- CVE-2026-66703Medium
A Cross Site Scripting (XSS) vulnerability in the MailOptin plugin (versions up to 1.2.78.0) occurs at the contributor level. A user with the contributor role can inject a malicious script that executes in the browsers of other users.
Original NVD description (English source)
Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows Privilege Escalation.This issue affects MailOptin: from n/a through <= 1.2.77.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS