{"metadata": {"vulnerability": "CVE-2026-109515", "count": 19, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-12T18:05:34.654Z", "date_only": false, "value": "2026-10-12T18:05:34.654Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-109515", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T18:20:28Z", "date_only": false, "value": "2026-10-12T18:20:28.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109515", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-15T16:09:03Z", "date_only": false, "value": "2026-10-15T16:09:03.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109515", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-16T04:27:01.480Z", "date_only": false, "value": "2026-10-16T04:27:01.480Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-109515", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T04:27:01.480Z", "date_only": false, "value": "2026-10-16T04:27:01.480Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-109515", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T05:10:04.950Z", "date_only": false, "value": "2026-10-16T05:10:04.950978Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxxsqoyjip2r", "record": "CVE-2026-109515", "field": "creation_timestamp", "uuid": "9c584d60-34ed-4100-b478-6dae9bc94ce3", "content": "CVE-2026-109515 - mailoptin \u2013 popup, optin forms & email newsletters for mailchimp, hubspot, aweber etc.\nThe MailOptin plugin for WordPress allows anyone on the internet to change the password of any existing\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#properfraction #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxxsqoyjip2r"}, {"timestamp": "2026-10-16T05:16:08.533Z", "date_only": false, "value": "2026-10-16T05:16:08.533594Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117448885405331593", "record": "CVE-2026-109515", "field": "creation_timestamp", "uuid": "d164d826-671b-4a90-a2fb-c0be8f51f037", "content": "CVE-2026-109515 MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter The MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names \u2014 including `ID` and `user_pass` \u2014 directly into `wp_insert_user()` via the `subscribe()` function. This makes it possible for unauthenticated attackers to force `wp_insert_user()` into UPDATE mode on any existing account by supplying a target user's numeric `ID`, overwrite that account's password with a pre-hashed value of their choosing, and thereby take over any WordPress user account \u2014 including administrators \u2014 leading to full site compromise. Exploitation requires that a WordPress User Registration opt-in form is published somewhere on the site, though the form's UUID is visible in page source and no authentication, nonce, or capability check is required to reach the vulnerable endpoint.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109515https://www.wordfence.com/threat-intel/vulnerabilities/id/96111116-6b6f-42fc-98d8-6f5c27dc3c1c?source=cvehttps://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/connections/WordPressUserRegistrationConnect/Subscription.php#L68https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/core/src/Connections/AbstractConnect.php#L84https://plugins.trac.wordpress.org/browser/mailoptin/tags/1.2.78.5/src/core/src/AjaxHandler.php#L699https://plugins.trac.wordpress.org/changeset?reponame=&new=3744644%40mailoptin%2Ftrunk&old=3738326%40mailoptin%2Ftrunk#file4https://plugins.trac.wordpress.org/changeset/3744644/mailoptin/trunk/src/connections/WordPressUserRegistrationConnect/Subscription.php#wordpress #properfraction #MailOptin\u2013Popup,OptinForms&EmailNewslettersforMailchimp,HubSpot,AWeberEtc.#CVE_2026_109515#bot", "url": "https://infosec.exchange/users/cve/statuses/117448885405331593"}, {"timestamp": "2026-10-16T05:17:29Z", "date_only": false, "value": "2026-10-16T05:17:29Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F6HJ-W62G-R97P", "record": "GHSA-F6HJ-W62G-R97P", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T05:17:29.597Z", "date_only": false, "value": "2026-10-16T05:17:29.597", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109515", "record": "FKIE_CVE-2026-109515", "field": "published"}, {"timestamp": "2026-10-16T06:05:18.002Z", "date_only": false, "value": "2026-10-16T06:05:18.002274Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/g32m3hsgvclnu", "record": "CVE-2026-109515", "field": "creation_timestamp", "uuid": "eb0721f1-eda3-4807-af18-8ebeb76b6ff2", "content": "CVE-2026-109515 - MailOptin\nCVE ID : CVE-2026-109515\n \n Published : Oct. 16, 2026, 5:17 a.m. | 16\u00a0minutes ago\n \n Description : The MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalat...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/g32m3hsgvclnu"}, {"timestamp": "2026-10-16T06:07:35.460Z", "date_only": false, "value": "2026-10-16T06:07:35.460367Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxxvxjwvyj22", "record": "CVE-2026-109515", "field": "creation_timestamp", "uuid": "644e4c0a-047d-4dc9-929b-43b18bece507", "content": "\ud83d\udea8 CVE-2026-109515 \u2014 CVSS 9.8 CRITICAL\n\nThe MailOptin \u2013 Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordP...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-109515\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxxvxjwvyj22"}, {"timestamp": "2026-10-16T06:30:26Z", "date_only": false, "value": "2026-10-16T06:30:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F6HJ-W62G-R97P", "record": "GHSA-F6HJ-W62G-R97P", "field": "published"}, {"timestamp": "2026-10-16T06:30:26Z", "date_only": false, "value": "2026-10-16T06:30:26Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F6HJ-W62G-R97P", "record": "GHSA-F6HJ-W62G-R97P", "field": "modified"}, {"timestamp": "2026-10-16T14:56:30.538Z", "date_only": false, "value": "2026-10-16T14:56:30.538755Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109515", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T14:56:30.538Z", "date_only": false, "value": "2026-10-16T14:56:30.538755Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109515", "record": "FKIE_CVE-2026-109515", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T15:09:39.848Z", "date_only": false, "value": "2026-10-16T15:09:39.848Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-109515", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:09:39.848Z", "date_only": false, "value": "2026-10-16T15:09:39.848Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-109515", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:17:07.900Z", "date_only": false, "value": "2026-10-16T15:17:07.900", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-109515", "record": "FKIE_CVE-2026-109515", "field": "lastModified"}, {"timestamp": "2026-10-16T18:00:15.071Z", "date_only": false, "value": "2026-10-16T18:00:15.071366Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mxz5ruoess2v", "record": "CVE-2026-109515", "field": "creation_timestamp", "uuid": "d3c17646-1250-4b55-8759-c3912e5a6a1a", "content": "MailOptin plugin. Any visitor becomes an admin. CVE-2026-109515, CVSS 9.8. Privilege escalation through unvalidated form parameters. No auth required. Update to 1.2.78.6 immediately. Scan your WordPress site: pulse-wp.com\n#WordPress #AccessControl #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3mxz5ruoess2v"}]}