What is the CVSS score of CVE-2026-3614?

CVE-2026-3614 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3614?

CVE-2026-3614 is a privilege escalation vulnerability in AcyMailing WordPress plugin (versions 9.11.0-10.8.1) that permits authenticated Subscriber-level users to escalate to administrator access…

How to fix or mitigate CVE-2026-3614?

Within 24 hours: Identify all WordPress instances running AcyMailing versions 9.11.0-10.8.1 via plugin audit tools and disable subscriber registration if not operationally critical. Within 7 days: Restrict AJAX access via Web Application Firewall rules to block wp_ajax_acymailing_router from unauthenticated sources, and disable the AcyMailing plugin entirely pending vendor patch release. Within 30 days: Monitor vendor advisory channels for patched version availability; upon release, update AcyMailing and re-enable with immediate post-update access audits.

WordPress CVE-2026-3614

EUVD-2026-23188 HIGH

Missing Authorization (CWE-862)

2026-04-16 Wordfence

Authentication Bypass WordPress Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 06:37 vuln.today

cvss_changed

Analysis Generated

Apr 16, 2026 - 06:01 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 05:45 euvd

EUVD-2026-23188

Analysis Generated

Apr 16, 2026 - 05:45 vuln.today

CVE Published

Apr 16, 2026 - 05:29 nvd

HIGH 8.8

DescriptionCVE.org

The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on the wp_ajax_acymailing_router AJAX handler. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access admin-only controllers (including configuration management), enable the autologin feature, create a malicious newsletter subscriber with an injected cms_id pointing to any WordPress user, and then use the autologin URL to authenticate as that user, including administrators.

AnalysisAI

Privilege escalation in AcyMailing WordPress plugin (versions 9.11.0-10.8.1) allows authenticated Subscriber-level users to gain administrator access through a multi-stage attack chain. Attackers exploit a missing capability check in the wp_ajax_acymailing_router AJAX handler to access admin-only configuration controllers, enable autologin features, inject malicious cms_id values into newsletter subscribers, and authenticate as any WordPress user including administrators. EPSS data not available; no confirmed active exploitation (CISA KEV absent), but the low attack complexity (AC:L) and detailed public code references increase exploitation risk for installations with subscriber registration enabled.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization) in the AcyMailing plugin's AJAX router implementation. The wp_ajax_acymailing_router handler in WpInit/Router.php (lines 11, 122, 230 across versions 10.7.1-10.8.1) fails to validate user capabilities before routing requests to backend controllers. WordPress AJAX handlers registered with wp_ajax_ hooks execute for authenticated users, but the plugin does not verify whether the authenticated user has administrative privileges before allowing access to sensitive operations in back/Core/AcymController.php. The autologin feature-intended for newsletter click tracking-generates authentication tokens tied to WordPress users via cms_id fields. By combining unauthorized configuration access with the ability to manipulate subscriber data and cms_id injection, attackers can generate valid autologin URLs that bypass normal WordPress authentication entirely. This represents a classic confused deputy problem where the plugin's privileged code trusts attacker-controllable input without proper authorization boundaries.

RemediationAI

Immediately upgrade AcyMailing plugin to version 10.8.2 or later, which addresses the missing capability check vulnerability (verify fix availability with AcyBA vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a895e2cf-9eba-4c46-b19f-d008e1058f64?source=cve). If immediate patching is not possible, implement these compensating controls: (1) Disable new subscriber registrations by removing self-registration capabilities and setting WordPress to disallow new user registrations (Settings → General → Membership); this prevents attackers from obtaining the required PR:L authenticated access, though existing Subscriber accounts remain a threat vector. (2) Implement Web Application Firewall (WAF) rules blocking POST requests to /wp-admin/admin-ajax.php with action=acymailing_router from non-administrator sessions; note this may break legitimate newsletter functionality for lower-privileged users. (3) Audit existing subscriber accounts for anomalous cms_id values using database queries (SELECT * FROM wp_acym_user WHERE cms_id IS NOT NULL) and verify autologin feature status in AcyMailing configuration-disable if not operationally required. (4) Monitor WordPress authentication logs for unexpected administrative logins using autologin URLs (look for acymailing_front_user parameter in access logs). These workarounds reduce attack surface but do not eliminate the vulnerability; patching remains the only complete remediation.