EUVD-2026-75889
GHSA-w97p-m43x-6fh6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable unauthenticated endpoint; AC:L because image-embedding is a plausible common config; C:H for arbitrary file read; no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The AcyMailing - An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the user[name] Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires "Embed images" option in AcyMailing configuration being enabled.
AnalysisAI
Path traversal in AcyMailing WordPress plugin (all versions through 11.0.4) exposes arbitrary server files to unauthenticated remote attackers via the unsanitized user[name] parameter. Exploitation is gated on the 'Embed images' configuration option being enabled, but when active, an attacker can read sensitive server-side files including WordPress configuration, credentials, and other data without any authentication. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The 'Embed images' feature must be explicitly enabled in AcyMailing plugin configuration - this is the single decisive prerequisite that activates the vulnerable code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects the pure confidentiality impact of unauthenticated arbitrary file read. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update AcyMailing to the version immediately following 11.0.4 (implied by the WordPress plugin repository changeset 3679457, which represents the upstream fix; the exact fixed release version is not explicitly stated in available data but is reflected in the plugin repository commit). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately disable the 'Embed images' configuration option in AcyMailing settings as an emergency mitigation, and audit server logs for suspicious file access attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Acymailing An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress
View allAcyMailing WordPress plugin (all versions through 10.11.1) allows authenticated attackers with subscriber-level access t
Authenticated privilege escalation in the AcyMailing WordPress plugin (versions up to and including 10.8.2) allows users
Privilege escalation in AcyMailing WordPress plugin (versions 9.11.0-10.8.1) allows authenticated Subscriber-level users
Stored Cross-Site Scripting in the AcyMailing WordPress newsletter plugin (all versions up to and including 10.10.2) per
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today