📄 WordPress Optional Email 1.3.11 Unauthenticated Administrator Account Takeover

WordPress Optional Email plugin version 1.3.11 contains an unauthenticated administrator account takeover vulnerability through Reset-Key Poisoning. A remote attacker can take over an administrator account. This proof of concept exploit demonstrates the vulnerable request flow against the affecte...

CVE-2025-15018

The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'randompassword' filter to registration contexts, allowing the filter to affect password reset key...

CVE-2025-15018

The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'randompassword' filter to registration contexts, allowing the filter to affect password reset key...

CVE-2025-15018

CVE-2025-15018: Affects Optional Email plugin for WordPress. Root cause: the plugin does not restrict its 'random_password' filter to registration contexts, allowing it to influence password reset key generation. Impact: unauthenticated attackers can set a known password reset key during password...

CVE-2025-15018 Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover

The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'randompassword' filter to registration contexts, allowing the filter to affect password reset key...

CVE-2025-15018 Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover

The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'randompassword' filter to registration contexts, allowing the filter to affect password reset key...

WordPress Optional Email plugin <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover vulnerability

Unauthenticated Privilege Escalation to Account Takeover vulnerability discovered by Drew Webber mcdruid in WordPress Plugin Optional Email versions = 1.3.11...

PT-2026-1599

Name of the Vulnerable Software and Affected Versions Optional Email versions prior to 1.3.12 Description The Optional Email plugin for WordPress is susceptible to a privilege escalation issue leading to account takeover. This occurs because the plugin does not limit the 'random password' filter ...

WordPress plugin Optional Email 安全漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPre...