Risk Letters

Exploited vulnerability

CVE-2026-109515

TLP:CLEAR

mailoptin mailoptin Improper Privilege Management

The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the

Facts

  • Vendor: mailoptin
  • Product: mailoptin
  • CVSS: 9.8
  • EPSS (probability of exploitation within 30 days): 0.4 %
  • First known exploitation: 16 October 2026
  • First seen by Risk Letters: 16 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD