TI-2026-04543 Aliases CVE-2026-5200 GHSA-54rj-qx28-9gcj

AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'

MEDIUM 40CWE-862Published 2026-05-20 · Updated 2026-05-20

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 10.8.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify privileged AcyMailing configuration, export subscriber secret keys, and chain these actions into administrator account takeover when a target administrator email address is known.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00336 27th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
acyba	AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress	up to 10.8.2	—	No fix listed	CNA

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress Vendoracyba Affected up to 10.8.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-5200
2026-10-03 Alias added: GHSA-54rj-qx28-9gcj

References

Other 2

TI-2023-20863 Extension - acymailing.com - RCE in AcyMailing component for Joomla 6.7.0-8.5.0 CVSS 3.1CRITICAL 9.8
TI-2018-06612 CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export… CVSS 3.0HIGH 8.8
TI-2018-06611 CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export… CVSS 3.0HIGH 8.8
TI-2024-06844 AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function CVSS 3.1HIGH 8.8
TI-2026-54189 Path traversal in acyba AcyMailing – An Ultimate Newsletter Plugin and Marketing… CVSS 3.1HIGH 7.5
TI-2026-12981 Improper privilege management in acyba AcyMailing – An Ultimate Newsletter Plugin and… CVSS 3.1HIGH 8.8

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences