PT-2026-1599 · WordPress · Optional Email

Drew Webber · Published 2026-01-07 · Updated 2026-01-12 · CVE-2025-15018

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Optional Email versions prior to 1.3.12

Description The Optional Email plugin for WordPress is susceptible to a privilege escalation issue leading to account takeover. This occurs because the plugin does not limit the 'random password' filter to registration contexts, which allows it to influence password reset key generation. An unauthenticated attacker can leverage this to set a predictable password reset key during a password reset request, enabling them to reset the password of any user, including administrators, and gain unauthorized access to accounts.

Recommendations Update the Optional Email plugin to version 1.3.12 or later.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-15018

Affected Products

Optional Email

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-15018 · Security Note
• https://twitter.com/0dayPublishing/status/2008821138948854193 · Twitter Post
• https://plugins.trac.wordpress.org/browser/optional-email/tags/1.3.11/optional-email.php?marks=44,51#L44 · Note
• https://t.me/CVEtracker/41590 · Telegram Post
• https://twitter.com/CveFindCom/status/2008881349029949717 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2010720926577693003 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ff4243e9-cf72-40d5-bc7d-204426024a1d?source=cve · Note
• https://twitter.com/cracbot/status/2010668131484942545 · Twitter Post
• https://twitter.com/TheHackerWire/status/2008935767318630520 · Twitter Post
• https://twitter.com/CVEnew/status/2008824740551577816 · Twitter Post