The Optional Email plugin for WordPress contains a critical privilege escalation vulnerability that allows unauthenticated attackers to hijack any user account, including administrative accounts.

This vulnerability is an authorization bypass (CWE-639) where the plugin fails to restrict the random_password filter to registration contexts. This flaw allows an unauthenticated attacker to manipulate password reset key generation, granting them full control over arbitrary user accounts.

Successful exploitation allows an attacker to gain complete control over any account on the WordPress site, including those with administrative privileges. Given the CVSS score of 9.8, this poses a critical threat to data confidentiality, system integrity, and service availability, potentially leading to a total compromise of the web application environment.

Immediate Action: There is currently no patched version available for this plugin. Administrators should immediately deactivate and uninstall the Optional Email plugin until a secure update is released by the vendor.

Proactive Monitoring: Review WordPress user account activity logs for unauthorized password resets or unexpected changes to administrative profiles. Monitor server access logs for anomalous requests targeting the password reset functionality.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter malicious requests, although deactivation remains the only guaranteed method to prevent exploitation of this logic flaw.

Public Exploit Available: Unknown.

The severity of this vulnerability necessitates immediate action to prevent full system compromise. Because the flaw allows for unauthenticated account takeover, administrators must prioritize the immediate removal of the affected plugin from their production environments. Monitor vendor channels closely for the release of a security patch before considering re-enabling the software.