What is the CVSS score of CVE-2026-66689?

CVE-2026-66689 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

AcyChecker CVE-2026-66689

EUVD-2026-57901 MEDIUM

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-mc42-vpmr-826j

WordPress Authentication Bypass Wordpress Plugin Anti Spam And List Cleaner 8211 Acychecker Acymailing Newsletter Team

6.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Description states 'unauthenticated', so PR:N is assessed; C/I/A:L reflects partial impact on plugin-scoped data without scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:12 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions.

AnalysisAI

Broken Access Control in the Anti Spam and list cleaner - AcyChecker WordPress plugin (versions <= 2.0.0) allows attackers to access or invoke restricted plugin functionality without proper authorization. Reported by Patchstack and tracked as EUVD-2026-57901, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints or AJAX handlers. Depending on the exposed functionality - which can include email list management, spam rule configuration, or subscriber data operations - an attacker could read, modify, or degrade plugin-controlled data. No public exploit has been identified at time of analysis.

Technical ContextAI

AcyChecker is a WordPress plugin developed by the AcyMailing Newsletter Team, designed for anti-spam filtering and mailing list hygiene (CPE: cpe:2.3:a:acymailing_newsletter_team:anti_spam_and_list_cleaner_–_acychecker:*:*:*:*:*:*:*:*). The root cause is CWE-862 (Missing Authorization): one or more plugin-registered REST API routes, AJAX actions, or admin-side endpoints fail to verify that the requesting user holds the required capability before executing privileged operations. In WordPress, this commonly occurs when a plugin registers wp_ajax_ or wp_ajax_nopriv_ hooks without a corresponding current_user_can() capability check, or when nonce verification is bypassed. The result is that functionality intended to be restricted to administrators or privileged roles is accessible to lower-privileged or, per the description, unauthenticated users. The CVSS vector assigns PR:L (low privileges), which is in tension with the vendor description of 'unauthenticated' - this discrepancy is noted under confidence.

RemediationAI

Upstream fix availability is not independently confirmed from the provided references - no patched release version is cited by Patchstack or the EUVD entry. WordPress site administrators should check the WordPress.org plugin repository or the AcyMailing vendor site for a version newer than 2.0.0 and upgrade immediately if available. If no patched version is available, the recommended compensating control is to deactivate and remove the AcyChecker plugin until a fix is released, accepting the trade-off of losing anti-spam list-cleaning functionality. Alternatively, restrict access to the WordPress admin area and AJAX endpoints (wp-admin/admin-ajax.php) to trusted IP ranges via web server or WAF rules - note this does not eliminate the vulnerability but significantly reduces the attack surface for unauthenticated vectors. Monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/acychecker/vulnerability/wordpress-anti-spam-and-list-cleaner-acychecker-plugin-2-0-0-broken-access-control-vulnerability for patch status updates.