What is the CVSS score of CVE-2026-5200?

CVE-2026-5200 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of AcyMailing are affected by CVE-2026-5200?

AcyMailing WordPress plugin (versions ≤10.8.2) contains an authenticated privilege escalation vulnerability enabling subscriber-level users to escalate to full administrator access.

How to fix or mitigate CVE-2026-5200?

24 hours: Deactivate AcyMailing plugin versions 10.8.2 and earlier across all WordPress installations. 7 days: Audit subscriber-level user accounts for signs of compromise; identify and evaluate replacement email marketing plugins. 30 days: Monitor vendor and Wordfence security advisories for patch availability; conduct full security assessment of affected sites.

AcyMailing CVE-2026-5200

EUVD-2026-31071 HIGH

Missing Authorization (CWE-862)

2026-05-20 Wordfence

GHSA-54rj-qx28-9gcj

WordPress Authentication Bypass Acymailing An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress Wordpress Plugin Acyba

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 08:15 vuln.today

DescriptionCVE.org

The AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 10.8.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify privileged AcyMailing configuration, export subscriber secret keys, and chain these actions into administrator account takeover when a target administrator email address is known.

AnalysisAI

Authenticated privilege escalation in the AcyMailing WordPress plugin (versions up to and including 10.8.2) allows users with subscriber-level access or higher to modify privileged plugin configuration and export subscriber secret keys. By chaining these missing authorization flaws with knowledge of an administrator's email address, attackers can achieve full administrator account takeover. No public exploit identified at time of analysis, but Wordfence - the reporting party - typically tracks WordPress plugin abuse closely.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization) in AcyMailing, a popular newsletter and marketing automation plugin for WordPress (CPE: cpe:2.3:a:acyba:acymailing_-_an_ultimate_newsletter_plugin_and_marketing_automation_solution_for_wordpress). The plugin exposes privileged action endpoints - including configuration modification and subscriber secret-key export - without verifying that the calling user holds the required capability. WordPress's role hierarchy means a subscriber account (the lowest authenticated role, often self-registerable on sites with open registration) is sufficient to invoke these endpoints, which should be restricted to administrators. The 'secret key' export likely enables forging password-reset or one-time-link flows tied to a target administrator email, producing the documented account takeover chain.

RemediationAI

Upstream fix available (WordPress.org plugin changeset 3516422); released patched version not independently confirmed from the provided data, so administrators should update AcyMailing to the latest available release from the WordPress.org plugin repository and verify the installed version is greater than 10.8.2 per the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f8470662-2247-4159-9dac-f13677c94bdf. As compensating controls until patching, disable new user self-registration in WordPress (Settings → General → 'Anyone can register') to remove the subscriber-attack surface - this prevents new community signups but stops anonymous-to-subscriber pivoting; alternatively, restrict access to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php AcyMailing-specific actions at the WAF or web-server layer, accepting that legitimate plugin functionality for low-privileged users may break. Audit existing subscriber accounts and rotate any administrator passwords and AcyMailing secret keys post-patch in case exposure already occurred.