High severity · published Apr 16, 2026
CVE-2026-3614
AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on the `wp_ajax_acymailing_router` AJAX handler. This makes it possible for authenticated attackers, with Subscriber-level access and above, to access admin-only controllers (including configuration management), enable the autologin feature, create a malicious newsletter subscriber with an injected `cms_id` pointing to any WordPress user, and then use the autologin URL to authenticate as that user, including administrators.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress · acyba
9.11.0 through 10.8.1 · source: vendor
Affected product
AA
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
acyba
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3614
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3614
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/acymailing/tags/10.7.1/WpInit/Router.php#L11
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/acymailing/tags/10.7.1/WpInit/Router.php#L122
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/acymailing/tags/10.7.1/WpInit/Router.php#L230
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/acymailing/tags/10.7.1/back/Core/AcymController.php#L92
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/acymailing/tags/10.8.1/back/Core/AcymController.php#L99
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/acymailing/trunk/WpInit/Router.php#L11
More from AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
8.8
CVE-2026-15426
AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update
8.8
CVE-2026-5200
AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'
7.5
CVE-2026-77807
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter
7.2
CVE-2026-102562
AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
6.4
CVE-2026-12170
AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute