PT-2026-33267 · WordPress · Acymailing

Ren Voza · Published 2026-04-16 · Updated 2026-04-20 · CVE-2026-3614

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AcyMailing versions 9.11.0 through 10.8.1

Description A missing capability check on the 'wp ajax acymailing router' AJAX handler allows authenticated attackers with Subscriber-level access or higher to access admin-only controllers, including configuration management. This flaw enables the activation of the autologin feature and the creation of a malicious newsletter subscriber with an injected cms id pointing to any user, allowing the attacker to authenticate as that user, including administrators.

Recommendations Update to version 10.8.2.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3614

Affected Products

Acymailing

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2026-3614 · Security Note
• https://twitter.com/CVEnew/status/2044701566255710646 · Twitter Post
• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.7.1/back/Core/AcymController.php#L92 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a895e2cf-9eba-4c46-b19f-d008e1058f64?source=cve · Note
• https://plugins.trac.wordpress.org/browser/acymailing/trunk/WpInit/Router.php#L11 · Note
• https://twitter.com/VulmonFeeds/status/2044761301197459731 · Twitter Post
• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.7.1/WpInit/Router.php#L11 · Note
• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.8.1/back/Core/AcymController.php#L99 · Note
• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.7.1/WpInit/Router.php#L230 · Note
• https://twitter.com/mysitesguru/status/2046302507987505633 · Twitter Post
• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.7.1/WpInit/Router.php#L122 · Note
• https://twitter.com/mysitesguru/status/2044853277733400628 · Twitter Post
• https://twitter.com/mysitesguru/status/2045058937179828452 · Twitter Post