What is the CVSS score of CVE-2026-57740?

CVE-2026-57740 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of AcyMailing (WordPress) are affected by CVE-2026-57740?

AcyMailing SMTP Newsletter plugin for WordPress (through version 10.11.1) contains a broken access control flaw allowing low-privileged authenticated users to access restricted newsletter…

How to fix or mitigate CVE-2026-57740?

Within 24 hours, audit all WordPress user accounts with access to AcyMailing plugin functionality and document current privilege levels, particularly identifying any low-privileged accounts with unnecessary newsletter management access. Within 7 days, restrict newsletter functionality access to only essential high-privileged accounts, disable low-privilege user access to the plugin where operationally feasible, and implement logging and monitoring of all newsletter-related activities. Within 30 days, monitor Patchstack advisories and the WordPress plugin repository for availability of a patched version addressing AcyMailing through version 10.11.1, and evaluate alternative newsletter plugins as a contingency if no patch becomes available within 60 days.

AcyMailing (WordPress) CVE-2026-57740

EUVD-2026-43382 HIGH

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Wordpress Plugin Acymailing Smtp Newsletter Acymailing Newsletter Team

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

7.1 HIGH

Network-reachable handler with low complexity and no UI, but missing-authorization abuse requires an authenticated low-privilege account (PR:L); impact is service disruption (A:H) plus limited data change (I:L), no confidentiality (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:40 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.1.

AnalysisAI

Broken access control in the AcyMailing SMTP Newsletter plugin for WordPress (versions up to and including 10.11.1) lets an authenticated low-privileged user reach functionality that should be restricted, impacting integrity and, most notably, availability of the plugin's newsletter/mailing operations. The flaw is a missing authorization check (CWE-862) reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Note an inconsistency in the source data: the CVE description states affected 'through <= 10.11.1' while the linked Patchstack advisory slug references 10.10.2 - the exact patched version is not confirmed from the input.

Technical ContextAI

AcyMailing SMTP Newsletter is an email/newsletter delivery plugin for WordPress used to compose and send mailings via SMTP. The single affected CPE is cpe:2.3:a:acymailing_newsletter_team:acymailing_smtp_newsletter:*. The root cause is CWE-862 (Missing Authorization): one or more plugin actions-typically exposed through WordPress admin-ajax.php or REST/nonce-gated handlers-fail to verify that the requesting user holds the required capability. In WordPress plugins this class of bug most often stems from a handler that authenticates the session but omits a current_user_can() capability check, so any logged-in account, including low-privilege roles such as Subscriber or Contributor, can invoke privileged operations. The CVSS vector (I:L, A:H) indicates the reachable functionality allows some data modification and, more significantly, disruption of the mailing service rather than data theft (C:N).

RemediationAI

Upgrade the AcyMailing SMTP Newsletter plugin to the vendor's fixed release beyond 10.11.1 as soon as it is confirmed available; no exact fix version is independently verified from the provided data, so consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/acymailing/vulnerability/wordpress-acymailing-smtp-newsletter-plugin-10-10-2-broken-access-control-vulnerability) and the vendor changelog for the precise patched build before deploying. Because exploitation requires an authenticated low-privileged account, an effective interim compensating control is to disable open user self-registration (Settings > General > 'Anyone can register') or set the default new-user role to the lowest capability, which shrinks the pool of accounts that can reach the vulnerable handler at the cost of blocking legitimate self-service signups. Additionally, restrict or monitor access to admin-ajax.php and the plugin's REST endpoints via a WAF rule and audit existing low-privilege accounts for unexpected mailing activity; a virtual patch through Patchstack or a WAF is a reasonable stopgap where immediate upgrade is not possible, with the trade-off of added request filtering overhead.