Auth bypass in Djanym Optional Email
CVE-2025-15018
The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to the plugin not restricting its 'random_password' filter to registration contexts, allowing the filter to affect password reset key generation. This makes it possible for unauthenticated attackers to set a known password reset key when initiating a password reset, reset the password of any user including administrators, and gain access to their accounts.
Vulnerability class: IDOR (Insecure Direct Object Reference)
EPSS: 0.003 (22.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Djanym Optional Email — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-15018?
- CVE-2025-15018 is a critical-severity vulnerability in Djanym Optional Email, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 9.8/10. Published 2026-01-07.
- How severe is CVE-2025-15018?
- Critical severity. CVSS v3 base score is 9.8 out of 10.