CVE-2025-15018

The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'random_password' filter to registration contexts, allowing the filter to affect password reset key generation. This makes it possible for unauthenticated attackers to set a known password reset key when initiating a password reset, reset the password of any user including administrators, and gain access to their accounts.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/optional-email/tags/1.3.11/optional-email.php?marks=44,51#L44
https://www.wordfence.com/threat-intel/vulnerabilities/id/ff4243e9-cf72-40d5-bc7d-204426024a1d?source=cve

Configurations

No configuration.

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El plugin Optional Email para WordPress es vulnerable a escalada de privilegios mediante toma de control de cuenta en todas las versiones hasta la 1.3.11, inclusive. Esto se debe a que el plugin no restringe su filtro 'random_password' a contextos de registro, lo que permite que el filtro afecte la generación de claves de restablecimiento de contraseña. Esto hace posible que atacantes no autenticados establezcan una clave de restablecimiento de contraseña conocida al iniciar un restablecimiento de contraseña, restablezcan la contraseña de cualquier usuario, incluidos los administradores, y obtengan acceso a sus cuentas.

Information

Published : 2026-01-07 12:16

Updated : 2026-10-07 09:10

NVD link : CVE-2025-15018

Mitre link : CVE-2025-15018

CVE.ORG link : CVE-2025-15018

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-15018", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15018", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-07T16:17:34.204773Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "djanym", "product": "Optional Email", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.3.11"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-07T12:16:58.540", "references": [{"url": "https://plugins.trac.wordpress.org/browser/optional-email/tags/1.3.11/optional-email.php?marks=44,51#L44", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ff4243e9-cf72-40d5-bc7d-204426024a1d?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'random_password' filter to registration contexts, allowing the filter to affect password reset key generation. This makes it possible for unauthenticated attackers to set a known password reset key when initiating a password reset, reset the password of any user including administrators, and gain access to their accounts."}, {"lang": "es", "value": "El plugin Optional Email para WordPress es vulnerable a escalada de privilegios mediante toma de control de cuenta en todas las versiones hasta la 1.3.11, inclusive. Esto se debe a que el plugin no restringe su filtro 'random_password' a contextos de registro, lo que permite que el filtro afecte la generaci\u00f3n de claves de restablecimiento de contrase\u00f1a. Esto hace posible que atacantes no autenticados establezcan una clave de restablecimiento de contrase\u00f1a conocida al iniciar un restablecimiento de contrase\u00f1a, restablezcan la contrase\u00f1a de cualquier usuario, incluidos los administradores, y obtengan acceso a sus cuentas."}], "lastModified": "2026-10-07T09:10:00.160", "sourceIdentifier": "security@wordfence.com"}