Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover
Vulnerability Description
The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'random_password' filter to registration contexts, allowing the filter to affect password reset key generation. This makes it possible for unauthenticated attackers to set a known password reset key when initiating a password reset, reset the password of any user including administrators, and gain access to their accounts.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15018
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Drew Webber
Affected Vendor
djanym
View all reports →