Executive Summary

The vulnerability exists in the AcyMailing WordPress plugin up to version 10.8.2 and is caused by missing authorization checks. This means the plugin does not properly verify whether a user is allowed to perform certain actions.

As a result, authenticated users with subscriber-level access or higher can exploit this flaw to modify privileged plugin configurations, export secret subscriber keys, and potentially escalate their privileges to take over administrator accounts if they know the administrator's email address.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized modification of critical plugin settings and exposure of sensitive subscriber secret keys.

Attackers can leverage these actions to escalate their privileges and take over administrator accounts, leading to full control over the affected WordPress site.

Such a compromise can result in data breaches, loss of site integrity, and disruption of services.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated attackers with subscriber-level access to modify privileged configurations, export subscriber secret keys, and potentially take over administrator accounts. This unauthorized access and potential data exposure could lead to violations of data protection regulations such as GDPR and HIPAA, which require strict controls over personal data and system access.

Specifically, the exposure of subscriber secret keys and unauthorized administrative access could result in breaches of confidentiality, integrity, and availability of sensitive data, which are core principles in these regulations.

Useful 0 Not Useful 0