EUVD-2026-56857
GHSA-pw82-xvrp-3rqp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the non-default 'Send website emails with AcyMailing' configuration required beyond the attacker's control; PR:L for mandatory subscriber account; full C/I/A:H for resulting admin account takeover.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the BCC field of the acy_notification_cms notification template, causing subsequent WordPress password-reset emails - including those targeting administrator accounts - to be silently copied to an attacker-controlled address, enabling account takeover via the captured reset link. Successful exploitation requires the site administrator to have enabled the "Send website emails with AcyMailing" option, which routes WordPress core notification emails through AcyMailing's templating system.
Articles & Coverage 1
AnalysisAI
AcyMailing WordPress plugin (all versions through 10.11.1) allows authenticated attackers with subscriber-level access to exploit an authorization bypass and silently overwrite the BCC field of the plugin's core notification template, redirecting all subsequent WordPress password-reset emails - including those for administrator accounts - to an attacker-controlled address. By then triggering the standard WordPress lost-password flow for any account, the attacker intercepts the one-time reset token and achieves full site administrator compromise without any victim interaction. No public exploit code or CISA KEV listing exists at time of analysis; exploitation is gated by a non-default plugin configuration that partially narrows the real-world attack surface below what the CVSS 8.8 score implies.
Technical ContextAI
AcyMailing (CPE: cpe:2.3:a:acyba:acymailing_-_an_ultimate_newsletter_plugin_and_marketing_automation_solution_for_wordpress:*:*:*:*:*:*:*:*) is a WordPress plugin that, when its 'Send website emails with AcyMailing' option is active, intercepts WordPress core transactional emails - including wp_mail() invocations for password resets - and routes them through AcyMailing's own templating engine rather than WordPress default mail handling. The vulnerable code paths span the plugin's authorization layer: AcymController.php (L99) and Router.php (L122) fail to verify that the authenticated user holds sufficient privilege to edit notification templates, allowing Edition.php (L344) and MailClass.php (L1496) to persist attacker-supplied field values against the 'acy_notification_cms' template. CWE-269 (Improper Privilege Management) is the precise root cause: WordPress subscriber roles carry no editorial or administrative capabilities, yet the plugin's action-level permission checks are absent or insufficient for template mutation operations, violating the principle of least privilege at the plugin's internal access control boundary.
RemediationAI
Update AcyMailing to a version above 10.11.1 as the primary remediation; an upstream code change is confirmed by WordPress plugin repository changeset 3632690 at https://plugins.trac.wordpress.org/changeset/3632690/acymailing, though the exact released plugin version containing this fix is not explicitly stated in available data - verify the current version in the WordPress plugin directory before assuming safety. As an immediate workaround where patching is delayed, navigate to AcyMailing settings and disable the 'Send website emails with AcyMailing' option; this severs the vulnerable code path entirely by restoring transactional email handling to WordPress core, with the trade-off that AcyMailing templating no longer applies to system notifications. Additionally, disabling open subscriber registration under WordPress Settings > General removes the low-privilege entry point for unauthenticated attackers, though it does not protect against internally compromised accounts. After patching, audit the BCC field of the 'acy_notification_cms' notification template for any unauthorized modifications made prior to remediation, as silent BCC persistence may already be in place on affected sites. Full advisory: https://www.wordfence.com/threat-intel/vulnerabilities/id/0c187d78-9f1d-4e55-a611-755ee30f855b.
More in Acymailing An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress
View allAuthenticated privilege escalation in the AcyMailing WordPress plugin (versions up to and including 10.8.2) allows users
Privilege escalation in AcyMailing WordPress plugin (versions 9.11.0-10.8.1) allows authenticated Subscriber-level users
Path traversal in AcyMailing WordPress plugin (all versions through 11.0.4) exposes arbitrary server files to unauthenti
Stored Cross-Site Scripting in the AcyMailing WordPress newsletter plugin (all versions up to and including 10.10.2) per
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today