Description

Unauthenticated Broken Access Control in Anti Spam and list cleaner &#8211; AcyChecker <= 2.0.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-13T14:17:10.113Z",
  "pubdate": "2026-08-13T14:17:10.113Z",
  "executiveSummary": "An unauthenticated broken access control vulnerability has been identified in the Anti Spam and list cleaner – AcyChecker plugin, specifically affecting versions 2.0.0 and below. This security flaw allows unauthenticated remote attackers to bypass authorization controls and interact with restricted functionalities intended for privileged users.\nThe impact of this vulnerability includes potential unauthorized data manipulation, configuration changes, or misuse of administrative features within the affected WordPress plugin.\nThe risk implication is significant as it exposes sensitive backend routines to the public internet without requiring valid credentials or session validation.\nAttackers do not require prior authentication or elevated privileges to exploit this flaw, lowering the attack complexity and barrier to entry.\nExploitation requirements are minimal, relying solely on network accessibility to the vulnerable target running the specified AcyChecker versions.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient or absent access control checks on critical functions or endpoints within the Anti Spam and list cleaner – AcyChecker plugin.\nSpecifically, the affected versions fail to validate whether an incoming request originates from an authenticated user possessing appropriate administrative or managerial capabilities before executing sensitive operations.\nThe vulnerable component resides within the codebase of the Anti Spam and list cleaner – AcyChecker product, affecting versions <= 2.0.0.\nThe attack vector involves network exposure, where an unauthenticated remote attacker crafts HTTP requests targeting unprotected functional routes or AJAX actions exposed by the plugin.\nThe attack flow proceeds as follows: First, the attacker identifies the exposed endpoint or function handled by the plugin. Second, the attacker sends a crafted HTTP request directly to the target without supplying authentication tokens, session cookies, or valid nonces. Third, due to the absence of robust permission enforcement and authorization validation, the underlying application processes the request. Finally, the plugin executes the restricted logic or performs the requested actions on behalf of the unauthenticated entity.\nThe privilege requirements are none, as the flaw is explicitly unauthenticated. Network exposure is external, requiring HTTP or HTTPS access to the vulnerable WordPress installation.\nPost-exploitation impact varies depending on the specific exposed functionality but generally permits unauthorized execution of plugin-specific administrative tasks, potentially leading to data tampering, resource abuse, or further system compromise depending on the scope of the vulnerable functions."
}