Acymailing An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress EUVD-2026-23188

Requires authenticated access to the WordPress site with Subscriber-level privileges or higher (PR:L in CVSS vector). WordPress installations allowing self-registration or providing Subscriber accounts to untrusted users are immediately exploitable. The AcyMailing plugin must be active (installed and enabled) in versions 9.11.0 through 10.8.1. No special WordPress configuration, non-default plugin settings, or user interaction is required beyond the attacker obtaining any authenticated account-the vulnerability exists in default AcyMailing deployments. Attack surface is network-accessible (AV:N) via standard WordPress AJAX endpoints. Exploitation is NOT limited by: disabled autologin features (attacker can enable via configuration access), newsletter campaign existence, or administrator activity. The primary limiting factor is the PR:L requirement-installations without subscriber registration or those restricting account creation to administrators significantly reduce risk, though insider threats or compromised low-privilege accounts remain vectors.

Real-world risk is HIGH for installations with open subscriber registration. The CVSS 8.8 score accurately reflects the severe impact (full CIA triad compromise at High) and realistic attack requirements: network-accessible (AV:N), low complexity (AC:L), requires only low-privileged authenticated access (PR:L), and no user interaction (UI:N). While no CISA KEV listing confirms active exploitation, multiple factors elevate practical risk: (1) WordPress Subscriber is the lowest authenticated role-often granted to self-registered users on public sites; (2) the attack chain is fully detailed in public WordPress plugin repository code (plugins.trac.wordpress.org references show exact vulnerable files and line numbers); (3) Wordfence threat intelligence has published comprehensive analysis, significantly lowering attacker research burden; (4) the vulnerability allows complete administrative takeover, not just data access. The missing EPSS score prevents probabilistic assessment, but the combination of low attacker skill requirements, detailed public disclosure, and widespread WordPress deployment suggests this will be exploited if not already. SSVC framework analysis: Exploitation=POC (public code analysis available), Automatable=Yes (AJAX endpoint with no CAPTCHA/rate limiting mentioned), Technical Impact=Total (admin access). Priority: IMMEDIATE patching for any installation allowing subscriber registration; HIGH priority for closed-user-base installations.

An attacker creates a free Subscriber account on a WordPress site running vulnerable AcyMailing versions. Using authenticated session cookies, the attacker sends crafted AJAX POST requests to wp-admin/admin-ajax.php with action=acymailing_router, bypassing capability checks to access admin-only configuration controllers. The attacker enables the autologin feature through configuration manipulation, then creates a malicious newsletter subscriber record with a cms_id value corresponding to a target administrator's WordPress user ID. The plugin generates an autologin URL tied to this subscriber-admin mapping. When the attacker accesses this URL, AcyMailing authenticates them as the targeted administrator without requiring credentials, granting full WordPress administrative control for site takeover, malware injection, or data exfiltration.