CVE-2026-5200: AcyMailing Authorization Flaw
High CVSS (8.8) vulnerability; prioritize internet-facing assets.
TL;DR - CVE-2026-5200 is a CVSS 8.8 missing-authorization vulnerability in AcyMailing for WordPress through version 10.8.2. - An authenticated subscriber-level user may alter privileged settings and export secret keys, potentially enabling administrator takeover. - No verified public proof of concept or confirmed active exploitation is known. - Upgrade promptly, restrict unnecessary account creation, and audit users, configuration changes, and administrator activity.
Summary
CVE-2026-5200 is a high-severity AcyMailing vulnerability affecting the WordPress plugin AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution through version 10.8.2.
The National Vulnerability Database describes a missing authorization check that may allow an authenticated attacker with subscriber-level access or higher to perform privileged AcyMailing actions. The reported attack chain includes modifying privileged configuration, exporting subscriber secret keys, and potentially taking over a WordPress administrator account when the administrator’s email address is known.
This issue is most significant on sites that permit public registration, operate membership workflows, or provide subscriber accounts to users who do not need broader WordPress privileges.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-5200 |
| Product | AcyMailing for WordPress |
| CVSS base score | 8.8 — High |
| CVSS vector | Not included in the retrieved NVD response |
| Authentication | Required |
| Privileges required | Subscriber-level access or higher, according to NVD |
| Confirmed vulnerable range | AcyMailing up to and including 10.8.2 |
| Patch status | A remediation reference exists, but the exact fixed version requires confirmation |
| CISA KEV | Not listed |
| Public PoC | No verified public PoC identified |
| Active exploitation | No confirmed in-the-wild exploitation identified |
NVD published the record on May 20, 2026, and last modified it on July 24, 2026. Organizations should treat AcyMailing installations running 10.8.2 or earlier as vulnerable until they are upgraded to a vendor-confirmed fixed release.
Analyst’s Take: The important question is whether a subscriber-level account can reach the affected functionality—not whether the attacker already controls an administrator account. Public registration and broad membership access make that prerequisite easier to satisfy. Because the exact fixed version is not conclusively established in the retrieved sources, verify the vendor’s current guidance before documenting remediation.
Root Cause
The root cause is a missing authorization control in AcyMailing’s WordPress functionality. One or more plugin actions do not adequately verify whether an authenticated WordPress user is permitted to invoke them.
Authentication confirms a user’s identity; it does not establish that the user may modify privileged configuration or retrieve sensitive values. A site can have strong passwords, multifactor authentication for administrators, and secure transport while remaining exposed if a low-privilege account can reach an administrative plugin action.
The NVD description identifies subscriber-level access as sufficient for the described attack path. Exploitation therefore does not depend on first compromising an administrator account.
The reported impact includes:
- Modification of privileged AcyMailing configuration
- Export of subscriber secret keys
- Potential administrator account takeover when the administrator’s email address is known
- Possible follow-on access to WordPress administration
- Unauthorized content changes, data exposure, phishing, spam, or malicious email campaigns
The retrieved evidence does not identify the precise vulnerable endpoint, parameter, nonce-handling defect, or code path. Administrators should not assume that blocking one URL or feature fully mitigates the issue. Treat AcyMailing administrative functionality as potentially exposed until the plugin is upgraded and the vendor’s fix has been verified.
For broader context on WordPress security issues, see our coverage of recent WordPress plugin vulnerabilities.
Who Is Exposed?
The directly affected product is AcyMailing for WordPress. NVD identifies the vulnerable range as all versions up to and including 10.8.2. The retrieved record does not provide a separate lower bound, so organizations should inventory any AcyMailing installation at or below version 10.8.2.
| Product | Affected versions | Platform | Required attacker access |
|---|---|---|---|
| AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution | Up to and including 10.8.2 | WordPress | Authenticated subscriber-level access or higher |
Sites face greater operational risk when they:
- Allow visitors to create accounts
- Use membership or customer-registration plugins
- Expose subscriber workflows
- Have large populations of low-privilege users
- Permit custom roles derived from or more permissive than the subscriber role
A compromised account from another vulnerability, password reuse, credential stuffing, or an insider could provide the authentication prerequisite described by NVD.
The vulnerability is not limited to sites where the attacker can already log in as an administrator. Subscriber-level access is the significant exposure condition. WordPress operators should review accounts with custom roles that may have equivalent or greater access.
Fixed Version Status
The exact fixed version is not conclusively established by the retrieved primary references. AcyMailing’s official changelog lists later releases, including 10.9.0 and releases in the 11.x series, but the available changelog content does not explicitly state which version fixes CVE-2026-5200.
Do not represent 10.9.0 as the definitive fixed version without confirming that claim against current vendor guidance or package metadata. Use the latest compatible release and verify the fix before closing the vulnerability.
Severity Breakdown
CVE-2026-5200 has a reported CVSS base score of 8.8, classified as High. The score reflects meaningful impact despite the authentication requirement. Subscriber-level access lowers the practical barrier to exploitation on sites that permit low-privilege accounts.
The exact CVSS vector string was not included in the retrieved NVD response. Because the vector determines the precise values for attack vector, attack complexity, privileges required, user interaction, scope, confidentiality, integrity, and availability, confirm those components directly in the NVD record before automated scoring or compliance reporting.
| CVSS element | Available assessment |
|---|---|
| Base score | 8.8 — High |
| Attack vector | Exact vector value not confirmed from retrieved data |
| Attack complexity | Not confirmed |
| Privileges required | Authenticated subscriber-level access or higher, per NVD |
| User interaction | Not confirmed |
| Scope | Not confirmed |
| Confidentiality impact | Potential exposure of subscriber secret keys and account data |
| Integrity impact | Potential modification of privileged configuration and administrator account compromise |
| Availability impact | Not specifically described in the retrieved sources |
| CVSS vector | Confirm directly in the NVD record |
The practical severity comes from the combination of low privilege requirements and a potentially high-impact attack chain. A site with no public registration and tightly controlled subscriber accounts may have a smaller attack surface, but it is not automatically safe.
Exploitation Status
No verified public proof-of-concept repository was identified in the retrieved searches. There is also no confirmed evidence of in-the-wild exploitation in the supplied sources.
CVE-2026-5200 is not currently listed in the CISA Known Exploited Vulnerabilities catalog. That means CISA has not confirmed exploitation through that program.
These findings are negative evidence, not proof that exploitation cannot occur. A vulnerability may be exploited without public reporting, without a GitHub repository, or before inclusion in CISA KEV. The authentication requirement may reduce broad internet scanning while leaving targeted WordPress sites exposed.
| Question | Current status |
|---|---|
| Public PoC available? | No verified public PoC identified |
| Active exploitation confirmed? | No confirmed in-the-wild exploitation identified |
| Listed in CISA KEV? | No |
| Ransomware campaign flag | None reported |
| Exploit prerequisites | Authenticated subscriber-level access or higher; the described takeover chain also requires knowledge of the target administrator’s email address |
Defenders should prioritize remediation based on exposure rather than waiting for a PoC or KEV listing. A public exploit would likely reduce the time required to weaponize the flaw, but the underlying risk exists now because the attack starts from a relatively low-privilege account.
Related WordPress Security Coverage
Organizations tracking WordPress plugin risk may also want to review our analysis of CVE-2026-1609. Related vulnerability reports can help security teams compare authentication requirements, privilege boundaries, exploitation status, and remediation urgency across their WordPress estate.
Sources
-
NVD: CVE-2026-5200 — CVE description, CVSS score, affected range, publication history, and remediation reference.
-
AcyMailing official changelog — Product verification and later release information. The retrieved content does not conclusively identify the fixed version for this CVE.
-
WordPress.org AcyMailing changeset 3516422 — Reference associated with the vulnerability record. The source returned HTTP 403 during retrieval, so the exact code change could not be independently confirmed.
-
Wordfence vulnerability intelligence — Additional vulnerability intelligence reference.
-
CISA Known Exploited Vulnerabilities Catalog — Current KEV status. CVE-2026-5200 is not listed in the supplied assessment.
The evidence supports three firm conclusions: AcyMailing versions through 10.8.2 are affected according to NVD; authenticated subscriber-level access may be sufficient for exploitation; and no verified public PoC or confirmed in-the-wild exploitation was identified. Confirm the exact fixed version and full CVSS vector through current vendor and NVD records, then prioritize upgrades on sites with public registration or broad subscriber access.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Detection should focus on:
- Unexpected AcyMailing configuration changes
- Access to sensitive export functionality
- Subscriber accounts accessing administrative plugin routes
- Creation or use of low-privilege accounts
- Administrator password resets or email-address changes
- New administrator accounts
- Unusual login locations or session activity
- Unexpected outbound email campaigns
Because the retrieved references do not identify the exact vulnerable endpoint or request parameter, monitoring should combine WordPress audit logs, web-server logs, identity-provider records, and AcyMailing-specific administrative events where available.
Review activity beginning with subscriber accounts and custom roles. Look for subscriber-level users making requests that alter AcyMailing settings, exporting subscriber data or secret keys, or performing actions followed by administrator-account changes.
Technical Notes
A generic web-server query can identify suspicious requests to WordPress administrative and plugin paths. Adapt the path expressions to the site’s logging format and confirm the actual AcyMailing routes in a controlled environment:
grep -Ei \
'(/wp-admin/|/wp-json/|admin-ajax\\.php|acymailing|export|secret|option)' \
/var/log/nginx/access.log \
| grep -Ei 'POST|admin-ajax|wp-json|acymailing'
For structured logs in a SIEM, a starting query can look for subscriber activity involving administrative paths or sensitive operations:
event.category:web
AND http.request.method:POST
AND (
url.path:/wp-admin/*
OR url.path:/wp-json/*
OR url.path:*admin-ajax.php*
OR url.query:*acymailing*
)
AND user.role:(subscriber OR "custom-low-privilege")
This is a detection heuristic, not a confirmed exploit signature. It may produce false positives because legitimate AcyMailing administration also uses WordPress administrative endpoints. Improve accuracy by enriching web events with the authenticated WordPress user ID and role, then alert when a subscriber-level identity performs a configuration or export action normally associated with administrators.
Also review WordPress audit records for events such as:
user_role_changed
user_created
user_password_changed
user_email_changed
administrator_added
plugin_settings_updated
The exact event names depend on the audit plugin or logging platform. If no audit capability is installed, preserve current web, PHP, WordPress, and database logs before making changes, then enable suitable auditing after remediation.
Remediation Steps
-
Inventory AcyMailing installations. Identify every WordPress site running AcyMailing and record the installed version. The confirmed vulnerable range is up to and including 10.8.2.
-
Upgrade to the latest supported AcyMailing release. The exact fixed version is not conclusively established in the retrieved references. AcyMailing’s changelog lists later releases, including 10.9.0 and 11.x versions, but the available material does not explicitly identify the CVE fix. Use the latest compatible release and confirm current vendor guidance.
-
Verify the installed version after upgrading. Confirm the version through the WordPress administrative interface, deployment inventory, or WP-CLI. Do not rely solely on a successful package operation.
-
Restrict account creation and privileges. Disable public registration where it is not required. Review subscriber and custom-role assignments, remove stale accounts, and ensure that users receive only the minimum access needed.
-
Rotate credentials and secrets if exposure is suspected. Because the issue may expose subscriber secret keys and may be chained into administrator takeover, investigate whether password resets, session invalidation, application-secret rotation, or user notification is required.
-
Audit administrator accounts and AcyMailing configuration. Look for unexpected administrator creation, email-address changes, password resets, configuration changes, subscriber exports, campaign modifications, and unusual outbound email activity.
-
Apply compensating controls while patching. Restrict access to WordPress administration, add multifactor authentication for privileged accounts, limit registration, and use a web-application firewall or reverse proxy to reduce exposure. These controls do not correct the authorization defect and should not replace upgrading.
Technical Notes
For WP-CLI environments, the following commands can help inspect and update the installed plugin when the deployment process permits:
wp plugin get acymailing --field=version
wp plugin update acymailing
wp plugin get acymailing --field=version
The plugin slug may differ between distribution channels or installations. If acymailing is not recognized, identify the installed slug first:
wp plugin list --format=table | grep -i acy
Before updating production, create a tested backup and validate compatibility with the site’s WordPress version, theme, mail transport, and other plugins. If the vendor’s current release requires a major-version migration, stage the change and test campaign, subscriber, and administrative workflows.
If immediate upgrade is impossible, use layered compensating controls:
- Disable public WordPress registration unless operationally required.
- Remove unused subscriber and custom-role accounts.
- Restrict /wp-admin/ and WordPress administrative APIs at the reverse proxy where feasible.
- Enforce MFA for all privileged accounts.
- Block or tightly limit access to unneeded AcyMailing administrative functions.
- Monitor and alert on subscriber-level POST requests to administrative or AcyMailing routes.
Because the exact vulnerable endpoint is not identified in the available research, do not deploy a narrowly targeted block and assume the issue is mitigated. Test any workaround against legitimate site functionality and continue pursuing the vendor-confirmed upgrade.