PT-2026-33267 · Acyba · Acymailing – An Ultimate Newsletter Plugin/Marketing Automation Solution For Wordpress

Ren Voza · Published 2026-04-16 · Updated 2026-04-16 · CVE-2026-3614

NVD

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on the wp ajax acymailing router AJAX handler. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access admin-only controllers (including configuration management), enable the autologin feature, create a malicious newsletter subscriber with an injected cms id pointing to any WordPress user, and then use the autologin URL to authenticate as that user, including administrators.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3614

Affected Products

Acymailing – An Ultimate Newsletter Plugin/Marketing Automation Solution For Wordpress

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-3614 · Security Note
• https://twitter.com/CVEnew/status/2044701566255710646 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a895e2cf-9eba-4c46-b19f-d008e1058f64?source=cve · Note
• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.7.1/WpInit/Router.php#L230 · Note
• https://plugins.trac.wordpress.org/browser/acymailing/trunk/WpInit/Router.php#L11 · Note
• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.7.1/WpInit/Router.php#L122 · Note
• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.8.1/back/Core/AcymController.php#L99 · Note
• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.7.1/WpInit/Router.php#L11 · Note
• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.7.1/back/Core/AcymController.php#L92 · Note