CVE-2025-15018

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15018", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-22T02:54:37.143Z", "datePublished": "2026-01-07T08:21:57.437Z", "dateUpdated": "2026-04-08T17:35:18.878Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:35:18.878Z"}, "affected": [{"vendor": "djanym", "product": "Optional Email", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.3.11", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'random_password' filter to registration contexts, allowing the filter to affect password reset key generation. This makes it possible for unauthenticated attackers to set a known password reset key when initiating a password reset, reset the password of any user including administrators, and gain access to their accounts."}], "title": "Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ff4243e9-cf72-40d5-bc7d-204426024a1d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/optional-email/tags/1.3.11/optional-email.php?marks=44,51#L44"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Drew Webber"}], "timeline": [{"time": "2025-12-19T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-06T19:57:29.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T16:17:34.204773Z", "id": "CVE-2025-15018", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:17:43.019Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15018", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-07T16:17:34.204773Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:17:39.680Z"}}], "cna": {"title": "Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover", "credits": [{"lang": "en", "type": "finder", "value": "Drew Webber"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "djanym", "product": "Optional Email", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.3.11"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-19T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-06T19:57:29.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ff4243e9-cf72-40d5-bc7d-204426024a1d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/optional-email/tags/1.3.11/optional-email.php?marks=44,51#L44"}], "descriptions": [{"lang": "en", "value": "The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'random_password' filter to registration contexts, allowing the filter to affect password reset key generation. This makes it possible for unauthenticated attackers to set a known password reset key when initiating a password reset, reset the password of any user including administrators, and gain access to their accounts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-07T08:21:57.437Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15018", "state": "PUBLISHED", "dateUpdated": "2026-01-07T16:17:43.019Z", "dateReserved": "2025-12-22T02:54:37.143Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T08:21:57.437Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Optional Email", "vendor": "djanym", "versions": [{"lessThanOrEqual": "1.3.11", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'random_password' filter to registration contexts, allowing the filter to affect password reset key generation. This makes it possible for unauthenticated attackers to set a known password reset key when initiating a password reset, reset the password of any user including administrators, and gain access to their accounts."}, {"lang": "es", "value": "El plugin Optional Email para WordPress es vulnerable a escalada de privilegios mediante toma de control de cuenta en todas las versiones hasta la 1.3.11, inclusive. Esto se debe a que el plugin no restringe su filtro 'random_password' a contextos de registro, lo que permite que el filtro afecte la generaci\u00f3n de claves de restablecimiento de contrase\u00f1a. Esto hace posible que atacantes no autenticados establezcan una clave de restablecimiento de contrase\u00f1a conocida al iniciar un restablecimiento de contrase\u00f1a, restablezcan la contrase\u00f1a de cualquier usuario, incluidos los administradores, y obtengan acceso a sus cuentas."}], "id": "CVE-2025-15018", "lastModified": "2026-10-07T09:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15018", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T16:17:34.204773Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:16:58.540", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/optional-email/tags/1.3.11/optional-email.php?marks=44,51#L44"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ff4243e9-cf72-40d5-bc7d-204426024a1d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:31:56.585521+00:00", "value": {"mitigation_remediation": ["Upgrade the Optional Email plugin to a version newer than 1.3.11, which eliminates the unrestricted use of the random_password filter.", "If upgrading is not immediately possible, disable or uninstall the Optional Email plugin to remove the attack surface.", "Implement multi\u2011factor authentication for all WordPress administrative accounts to reduce the impact of a compromise.", "Regularly monitor account reset logs for unexpected activity."], "summary": {"action": "Immediate Patch", "impact": "Account takeover via privilege escalation"}, "threat_synthesis": {"affected_systems": "Any WordPress site that has the Optional Email plugin version 1.3.11 or earlier installed. The flaw exists in all releases up to and including 1.3.11 and removes the restriction on the password\u2011reset process for those versions.", "description_and_impact": "The Optional Email plugin for WordPress is vulnerable because its 'random_password' filter is applied outside of registration contexts, creating a CWE-639 weakness that allows an unauthenticated attacker to set a known password reset key when initiating a password reset. By doing so, the attacker effectively bypasses authorization checks and can reset the password for any user, including administrators, achieving full account takeover.", "risk_and_exploitability": "The flaw carries a CVSS score of 9.8, indicating critical severity, but its EPSS score of <1% indicates that widespread exploitation is unlikely under current conditions. It is not listed in CISA\u2019s KEV catalog. Exploitation is possible by an unauthenticated attacker visiting the public password\u2011reset page, selecting a pre\u2011known key, and resetting a target user\u2019s password. Once the password is changed, the attacker can log in to any account, including those with administrative privileges."}}}}, "created": "2026-01-08T09:49:38.716515+00:00", "updated": "2026-04-21T00:45:23.084050+00:00", "vendors": ["djanym", "djanym$PRODUCT$optional_email", "wordpress", "wordpress$PRODUCT$wordpress"]}