AcyMailing CVE-2026-77807

The 'Embed images' feature must be explicitly enabled in AcyMailing plugin configuration - this is the single decisive prerequisite that activates the vulnerable code path. Without this option enabled, the vulnerable parameter is not processed and the flaw is not reachable. Exploitation is otherwise unconstrained: no authentication is required (PR:N), the vector is fully remote over HTTP (AV:N), and no user interaction or special client state is needed (UI:N). The attacker is limited to read-only access (I:N/A:N); no file write or code execution is possible through this vector alone. Files accessible are limited to those readable by the web server process user - typically including wp-config.php, application source, and server configuration files, but not necessarily root-owned system files.

The CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects the pure confidentiality impact of unauthenticated arbitrary file read. The key real-world risk moderator is the requirement that 'Embed images' be enabled in AcyMailing configuration - this is a specific opt-in feature, which meaningfully limits the exposed population. Newsletter senders who rely on inline image embedding in campaigns would be most likely to have this enabled, and since AcyMailing is a marketing tool, image embedding is a plausible but not universal default. No EPSS data was provided in the input; no KEV listing exists; no POC is referenced. This is a medium-urgency patching priority: significant CVSS score with a real-world mitigating condition, no active exploitation evidence, and a patch available. Organizations using AcyMailing with image embedding enabled should treat this as a priority.

An unauthenticated attacker identifies a WordPress site running AcyMailing ≤11.0.4 with 'Embed images' enabled and sends a crafted HTTP request supplying a path traversal payload such as ../../../../etc/passwd or ../../../../wp-config.php in the user[name] parameter. The plugin resolves the path without sanitization, and the server returns the file contents to the attacker, exposing WordPress database credentials or other sensitive configuration data. No public proof-of-concept has been identified at time of analysis, but the attack is straightforward given the known parameter and traversal technique.