MailOptin WordPress Plugin Privilege Escalation Vulnerability

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6.

The subscribe_to_email_list endpoint accepts an attacker-supplied optin_data[form_custom_field_mappings] parameter without any allow-list validation on destination keys. This allows the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary wp_users column names, including ID and user_pass, directly into wp_insert_user() via the subscribe() function.

• Affected versions: all versions up to and including 1.2.78.6
• Precondition: a WordPress User Registration opt-in form is published somewhere on the site; the form's UUID is visible in page source
• No authentication, nonce, or capability check is required to reach the vulnerable endpoint
• Impact: unauthenticated attackers can overwrite any existing account's password and take over any WordPress user account, including administrators, leading to full site compromise