PT-2026-42114 · WordPress · Acymailing

Azril Fathoni · Published 2026-05-20 · Updated 2026-05-20 · CVE-2026-5200

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress versions prior to 10.8.3

Description The plugin fails to properly verify if a user is authorized to perform specific actions. This allows authenticated attackers with subscriber-level access or higher to modify privileged configuration settings and export subscriber secret keys. If a target administrator's email address is known, these actions can be chained to achieve a full administrator account takeover. The issue is associated with the acymailing router endpoint.

Recommendations Update the plugin to a version later than 10.8.2.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-5200

Affected Products

Acymailing

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-5200 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f8470662-2247-4159-9dac-f13677c94bdf?source=cve · Note
• https://t.me/CVEtracker/54359 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3516422/acymailing · Note