CVE-2022-36340 MEDIUM

CVE-2022-36340: WordPress MailOptin plugin <= 1.2.49.0 - Unauthenticated Optin Campaign Cache Deletion vulnerability

Vendor Mailoptin Popup Builder Team

Product MailOptin (WordPress plugin)

Weakness CWE-862 · Missing authorization

Published September 23, 2022

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

MailOptin version 1.2.49.0 and earlier lacks proper authorization checks, allowing unauthenticated attackers to modify site data. An attacker can send a network request to alter plugin settings or content without needing to log in. This affects the plugin's core functionality and could lead to unauthorized changes to email campaigns or subscriber data.

What an attacker can do

03Attacker Capabilities

Modify plugin settings and data without logging in to the site.

Potential impact on your site

04Site Impact

Attackers can alter MailOptin campaigns, subscriber lists, or settings without your knowledge or permission.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

September 23, 2022 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-36340 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities

Identifiers

CVE CVE-2022-36340

CWE CWE-862

CVSS 6.5 / MEDIUM

Affected versions