CVE-2026-15426

Deferred Deferred - Pending Action

Authorization Bypass in AcyMailing WordPress Plugin

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: Wordfence

Description

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the BCC field of the acy_notification_cms notification template, causing subsequent WordPress password-reset emails — including those targeting administrator accounts — to be silently copied to an attacker-controlled address, enabling account takeover via the captured reset link. Successful exploitation requires the site administrator to have enabled the "Send website emails with AcyMailing" option, which routes WordPress core notification emails through AcyMailing's templating system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-15426

EUVD

EUVD-2026-56857

Affected Vendors & Products

Vendor	Product	Version / Range
acyba	acymailing	to 10.11.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in the AcyMailing WordPress plugin up to version 10.11.1. It allows authenticated attackers with subscriber-level access or higher to modify the BCC field in a notification template. This causes WordPress password-reset emails, including those for admin accounts, to be secretly sent to an attacker-controlled address. The attacker can then use the captured reset link to take over the account.

Detection Guidance

Check WordPress plugin versions for AcyMailing up to 10.11.1. Review email routing settings to confirm if AcyMailing handles password-reset emails. Monitor email headers for unexpected BCC fields in WordPress notifications.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized account takeover of WordPress admin accounts. Attackers can intercept password-reset emails, gain control over critical accounts, and potentially compromise the entire website. Successful exploitation requires the site admin to have enabled the 'Send website emails with AcyMailing' option.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, such as admin accounts, which may violate compliance requirements under GDPR or HIPAA. Unauthorized access to personal data or protected health information could result in legal penalties, data breaches, and loss of trust.

Mitigation Strategies

Update AcyMailing plugin to the latest version. Disable the 'Send website emails with AcyMailing' option in WordPress settings. Review user roles and restrict subscriber-level access to prevent unauthorized changes.

Hi! I’m here to help you understand CVE-2026-15426. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70