Description

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the BCC field of the acy_notification_cms notification template, causing subsequent WordPress password-reset emails — including those targeting administrator accounts — to be silently copied to an attacker-controlled address, enabling account takeover via the captured reset link. Successful exploitation requires the site administrator to have enabled the "Send website emails with AcyMailing" option, which routes WordPress core notification emails through AcyMailing's templating system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-11T19:17:20.447Z",
  "pubdate": "2026-08-11T19:17:20.447Z",
  "executiveSummary": "The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress, in all versions up to and including 10.11.1, suffers from an authorization bypass vulnerability.\nThe root cause stems from insufficient privilege verification on functions handling notification template configurations.\nThis flaw allows authenticated attackers with subscriber-level access and above to manipulate sensitive plugin settings.\nSpecifically, an attacker can overwrite the Blind Carbon Copy (BCC) field of the acy_notification_cms notification template.\nWhen successfully exploited, subsequent WordPress core notification emails—including administrative password-reset tokens—are silently redirected or copied to an attacker-controlled email address.\nThis exfiltration of password-reset links directly facilitates full account takeover of targeted user accounts, including high-privileged administrator accounts.\nExploitation prerequisites require the target site administrator to have previously enabled the 'Send website emails with AcyMailing' option, routing standard WordPress transactional emails through the vulnerable templating and mailing engine.\nThe risk implication is critical, as low-privileged users can escalate their privileges indirectly through intercepted administrative authentication tokens.",
  "technicalDetails": "The vulnerability resides within the authorization enforcement mechanisms of the AcyMailing plugin for WordPress, specifically affecting versions up to and including 10.11.1.\nThe root cause is a failure in access control enforcement, where the application processes modification requests to notification templates without validating whether the requesting user possesses the necessary administrative capabilities or correct authorization context.\nAuthentication requirements are minimal, as the attack can be executed by any authenticated user holding subscriber-level access and above.\nNetwork exposure is standard for web-based WordPress installations, requiring HTTP/HTTPS access to the administrative or front-end endpoints exposed by the plugin.\nThe attack flow proceeds as follows: First, an attacker authenticates to the WordPress site with a low-privileged subscriber account. Second, the attacker crafts an HTTP request targeting the vulnerable component responsible for updating the acy_notification_cms notification template. Due to the missing capability checks and authorization bypass, the application processes the request. Third, the attacker injects payload data designed to modify the BCC field of the acy_notification_cms template to point to an external, attacker-controlled email address.\nOnce the template is successfully poisoned, the payload behavior alters the delivery routing of subsequent transactional emails generated by the WordPress core. This requires the site administrator to have explicitly enabled the 'Send website emails with AcyMailing' configuration setting.\nWhen a targeted user, such as a site administrator, initiates a password-reset procedure, WordPress generates the standard password-reset notification email. This email is intercepted and routed through AcyMailing's templating system.\nBecause the acy_notification_cms template now contains the malicious BCC instruction, a duplicate of the administrative password-reset email is silently transmitted to the attacker's email address.\nThe post-exploitation impact is severe; the attacker extracts the valid, time-sensitive password-reset link from the intercepted email, navigates to the reset URL, updates the administrator's credentials, and achieves complete administrative account takeover."
}