CVE-2026-5200
AcyMailing Plugin Missing Authorization Vulnerability
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| acymailing | acymailing | to 10.8.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the AcyMailing WordPress plugin up to version 10.8.2 and is caused by missing authorization checks. This means the plugin does not properly verify whether a user is allowed to perform certain actions.
As a result, authenticated users with subscriber-level access or higher can exploit this flaw to modify privileged plugin configurations, export secret subscriber keys, and potentially escalate their privileges to take over administrator accounts if they know the administrator's email address.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated attackers with subscriber-level access to modify privileged configurations, export subscriber secret keys, and potentially take over administrator accounts. This unauthorized access and potential data exposure could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict controls over personal data and system access.
Specifically, the exposure of subscriber secret keys and unauthorized administrative access could result in breaches of confidentiality, integrity, and availability of sensitive data, which are core principles in these regulations.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized modification of critical plugin settings and exposure of sensitive subscriber secret keys.
Attackers can leverage these actions to escalate their privileges and take over administrator accounts, leading to full control over the affected WordPress site.
Such a compromise can result in data breaches, loss of site integrity, and disruption of services.