CVE-2025-15018

Name of the Vulnerable Software and Affected Versions Optional Email versions prior to 1.3.12

Description The Optional Email plugin for WordPress is susceptible to a privilege escalation issue leading to account takeover. This occurs because the plugin does not limit the 'random password' filter to registration contexts, which allows it to influence password reset key generation. An unauthenticated attacker can leverage this to set a predictable password reset key during a password reset request, enabling them to reset the password of any user, including administrators, and gain unauthorized access to accounts.

Recommendations Update the Optional Email plugin to version 1.3.12 or later.