CVE-2025-15018: 
WordPress vulnerability analysis and mitigation

CVE-2025-15018 is a Privilege Escalation via Account Takeover vulnerability in the Optional Email plugin for WordPress, affecting all versions up to and including 1.3.11. The flaw allows unauthenticated attackers to take over any user account, including administrator accounts, by manipulating the password reset process. It was published on January 7, 2026, and was reported by Wordfence. It carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The plugin's random_password filter, intended only for registration contexts, is not properly scoped and inadvertently applies to password reset key generation as well. This allows an unauthenticated attacker to supply a known or predictable value as the password reset key when initiating a reset request, then use that key to complete the reset and gain access to any account. The vulnerable code can be reviewed in the plugin source at lines 44–51 of optional-email.php version 1.3.11 (Wordfence, Plugin Source).

Successful exploitation grants an unauthenticated attacker full control over any WordPress user account, including site administrators, resulting in high confidentiality, integrity, and availability impact. An attacker who compromises an administrator account can achieve complete site takeover — installing malicious plugins, exfiltrating sensitive data, defacing content, or establishing persistent backdoors. The scope of impact extends to all site users and any data stored within the WordPress installation (Wordfence).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Wordfence). The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it highly attractive for exploitation if a PoC becomes public. The EPSS score is approximately 0.074%, indicating a currently low but non-negligible probability of exploitation in the near term. CVE-2025-15018 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time.

1. Reconnaissance: Identify WordPress sites running the Optional Email plugin (versions ≤ 1.3.11) using tools like WPScan, Shodan, or by checking publicly accessible readme.txt files in the plugin directory (/wp-content/plugins/optional-email/readme.txt).
2. Initiate password reset: Send a password reset request for a target user (e.g., an administrator) via the WordPress lost password form (/wp-login.php?action=lostpassword), supplying the target's username or email.
3. Inject known reset key: Because the plugin's random_password filter is not restricted to registration contexts, craft the request so that the filter is triggered during reset key generation, substituting a known/attacker-controlled value as the reset key.
4. Complete password reset: Use the known reset key to access the password reset URL (/wp-login.php?action=rp&key=<known_key>&login=<username>) and set a new password for the target account.
5. Account takeover: Log in with the newly set password and gain full access to the compromised account, including administrator privileges if the target was an admin (Wordfence, Plugin Source).

• Network: Unusual or repeated POST requests to /wp-login.php?action=lostpassword for administrator or privileged accounts from unknown or unexpected IP addresses; subsequent GET requests to /wp-login.php?action=rp&key=... shortly after reset initiation.
• Logs: WordPress authentication logs showing password reset completions for admin accounts not initiated by the account owner; login events from unfamiliar IP addresses following a password reset.
• File System: Newly installed or modified plugins/themes after a suspicious login; presence of web shells or backdoor files in the WordPress directory.
• Process/Behavior: Unexpected administrator account creation, privilege changes, or plugin installations in the WordPress admin dashboard audit log.

Site administrators should immediately update the Optional Email plugin to a version newer than 1.3.11 once a patched release is available from the vendor. If no patch is yet available, the plugin should be deactivated and removed until a fix is released. As interim measures, enable multi-factor authentication for all administrator accounts, restrict access to wp-login.php by IP allowlist where feasible, and monitor access logs for suspicious password reset activity (Wordfence).

Wordfence, which discovered and reported the vulnerability, published details in their threat intelligence portal and included it in their weekly WordPress vulnerability report for the week of January 5–11, 2026. The vulnerability was also referenced in the CISA weekly vulnerability bulletin (SB26-012) for the week of January 5, 2026. Social media coverage was limited, with brief mentions on Bluesky and Mastodon from security news aggregators (Wordfence Blog, CISA Bulletin).