AcyMailing CVE-2026-5200

Attacker must hold an authenticated WordPress account at subscriber role or higher on a site running AcyMailing 10.8.2 or earlier - trivially achievable on the very common WordPress configuration where 'Anyone can register' is enabled, otherwise requiring prior compromise of any low-privileged account. Successful chaining to administrator takeover additionally requires the attacker to know (or guess/enumerate) the email address of a target administrator account; this is typically discoverable via the WordPress REST API users endpoint, author archive pages, or public site metadata. No user interaction by the victim administrator is required (UI:N), and the AcyMailing plugin must be installed and active in a default configuration - no special non-default plugin setting is called out in the description.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures real risk: network-reachable, low complexity, only subscriber-level privileges required, no user interaction, and full confidentiality/integrity/availability impact via admin takeover. On WordPress sites that allow open user registration (extremely common for membership, e-commerce, and community sites), the PR:L barrier collapses to near-zero in practice. EPSS data was not provided, and the CVE is not in CISA KEV - so this is not confirmed actively exploited. No public exploit identified at time of analysis, but the changeset is publicly visible in plugins.trac.wordpress.org, which means diff-based reverse engineering of the fix is trivial and time-to-exploit is likely short. This should be treated as a priority patch for any WordPress site running AcyMailing, particularly those with open registration.

An attacker registers a free subscriber account on a target WordPress site running AcyMailing ≤10.8.2 (or compromises any existing low-privileged account), then issues authenticated requests to the unprotected AcyMailing endpoints to export the secret key associated with a known administrator email address (often discoverable from /wp-json/wp/v2/users, author archives, or public 'contact the editor' pages). Using the exported secret key, the attacker forges a privileged authentication artifact (e.g., a magic-link or password-reset token) tied to that admin email and authenticates as administrator, achieving full site takeover. No public exploit identified at time of analysis, but the patch changeset is publicly browsable.