BaseFortify

Executive Summary

CVE-2026-57740 is a Missing Authorization vulnerability in the AcyMailing SMTP Newsletter plugin for WordPress, affecting versions up to 10.11.1.

This vulnerability is a Broken Access Control issue that allows unprivileged users, such as Subscribers, to perform actions that normally require higher privileges due to missing authorization, authentication, or nonce token checks.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can be exploited by attackers to perform unauthorized actions within the AcyMailing SMTP Newsletter plugin.

This could lead to attackers conducting mass campaigns or other malicious activities by leveraging higher privileges they should not have.

The CVSS score of 7.1 indicates a moderate level of danger, with potential impacts including integrity loss and high availability impact.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves missing authorization in the AcyMailing SMTP Newsletter Plugin, allowing unprivileged users to perform higher-privileged actions. Detection would involve monitoring for unauthorized access attempts or unusual privilege escalations related to the plugin.

Since no official patch or specific detection commands are provided, it is recommended to check plugin versions to identify if the vulnerable version (10.11.1 or below) is in use.

A possible command to check the installed plugin version on a WordPress site via command line is:

• wp plugin list --status=active | grep acymailing

Additionally, monitoring web server logs for suspicious requests targeting the AcyMailing SMTP Newsletter endpoints or unusual POST requests from low-privileged users could help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the AcyMailing SMTP Newsletter Plugin to a version higher than 10.11.1 once available.

Since no official patch is currently available, applying the mitigation rule provided by Patchstack to block attacks is advised.

Other recommended actions are to seek assistance from your hosting provider or a developer to implement temporary access control measures.

Monitoring and restricting user privileges to prevent unprivileged users from performing higher-privileged actions can also reduce risk.

Useful 0 Not Useful 0