CVE-2026-102562: AcyMailing WordPress Plugin XSS Vulnerability

CVE-2026-102562 Overview

CVE-2026-102562 is a stored cross-site scripting (XSS) vulnerability in the AcyMailing plugin for WordPress, affecting all versions up to and including 11.1.0. Unauthenticated attackers can inject arbitrary web scripts through the customField[] parameter of the public frontusers::subscribe endpoint. The malicious payload persists in subscriber field data and executes when any user, including administrators, accesses the online-archive URL for the poisoned subscriber. This condition is tracked as CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in administrator browsers via the Subscribers → History screen, enabling session theft or administrative account takeover.

Affected Products

AcyMailing plugin for WordPress versions up to and including 11.1.0
WordPress installations exposing the public frontusers::subscribe endpoint
Sites using the AcyMailing online-archive view functionality

Discovery Timeline

2026-10-13 - CVE-2026-102562 published to the National Vulnerability Database (NVD)
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-102562

Vulnerability Analysis

The vulnerability chains three weaknesses in AcyMailing's subscriber handling pipeline. Unauthenticated users can submit arbitrary data to the frontusers::subscribe endpoint using the customField[] array parameter. The data is stored against subscriber field records and later rendered inside the mail body of the online archive view without proper HTML encoding.

An attacker crafts a malicious subscription request containing script payloads in customField[] values. The poisoned record is then served to any viewer of the subscriber's online-archive URL. Administrators are a high-value target because the plugin exposes direct links to these archive URLs from the Subscribers → History screen in wp-admin.

Successful exploitation runs attacker-controlled JavaScript in the context of the WordPress admin session. This enables cookie theft, cross-site request forgery against privileged endpoints, and persistent backdoor installation through plugin or theme modification.

Root Cause

The root cause lies in the acym_cleanVar() sanitizer defined in back/Core/wordpress/security.php. The HTML-tag stripping logic only matches complete tags that include a closing > character. Payloads crafted with malformed or truncated tag syntax bypass the stripper entirely.

The tainted value then flows through SubscriberInsertion::replaceUserInformation() in back/dynamics/subscriber/SubscriberInsertion.php and is substituted into the mail body. The archive view template at front/FrontViews/Archive/tmpl/view.php emits the stored value directly without applying esc_html() or equivalent output encoding.

Attack Vector

The attack vector is remote and unauthenticated over the network. An attacker sends a crafted POST request to the public subscription endpoint handled by FrontusersController with a malicious customField[] payload. No user interaction is required to persist the payload. Execution occurs when a victim loads the subscriber's online-archive page, which the plugin links from the administrator Subscribers → History interface.

The vulnerability mechanism is described in the Wordfence Vulnerability Report and corroborated by the vendor's AcyMailing Change Set Overview.

Detection Methods for CVE-2026-102562

Indicators of Compromise

POST requests to the frontusers::subscribe endpoint containing <script, onerror=, onload=, javascript:, or malformed HTML tag fragments in customField[] parameters
Subscriber records in the AcyMailing database tables with field values containing script tags, event handlers, or HTML without closing > characters
Outbound requests from administrator browsers to attacker-controlled domains shortly after visiting the Subscribers → History screen
Unexpected administrator session activity, new user creations, or plugin or theme file modifications following archive URL visits

Detection Strategies

Review web server access logs for POST requests to ?option=com_acym&ctrl=frontusers&task=subscribe or equivalent routes with suspicious payloads in form fields
Query the AcyMailing subscriber field tables for stored values matching XSS signatures such as <script, on\w+=, or <svg
Deploy a web application firewall (WAF) rule to flag unsanitized HTML in subscription form submissions targeting WordPress endpoints

Monitoring Recommendations

Monitor WordPress audit logs for administrator access to AcyMailing archive URLs and correlate with subsequent privileged actions
Alert on new WordPress administrator accounts, modifications to wp_users capabilities, or changes to active plugins following archive page visits
Track outbound HTTP connections originating from browsers of users authenticated to wp-admin for connections to unfamiliar domains

How to Mitigate CVE-2026-102562

Immediate Actions Required

Update the AcyMailing plugin to the version released after 11.1.0 that addresses this issue, as referenced in the vendor change set
Audit existing subscriber custom field values and purge any records containing HTML, script tags, or event handler attributes
Rotate WordPress administrator credentials and invalidate active sessions if archive URLs for suspicious subscribers have been accessed

Patch Information

The vendor published a fix in the AcyMailing Change Set Overview. Site administrators should upgrade through the WordPress plugin manager to the latest release above version 11.1.0. Verify the installed version in wp-admin → Plugins after upgrading.

Workarounds

Temporarily disable the AcyMailing plugin until the patched version can be deployed
Restrict public access to the frontusers::subscribe endpoint using WAF rules that block requests containing HTML or script syntax in customField[] parameters
Disable the online-archive feature if not required to prevent rendering of stored subscriber field values
Enforce a strict Content Security Policy (CSP) on wp-admin to block inline script execution from injected payloads

bash

# Example WAF rule (ModSecurity) to block script payloads in customField submissions
SecRule ARGS_NAMES "@rx ^customField\[" \
  "id:1026102562,\
   phase:2,\
   t:none,t:lowercase,\
   deny,status:403,\
   msg:'CVE-2026-102562 AcyMailing XSS attempt',\
   chain"
  SecRule ARGS "@rx (?i)(<script|on\w+\s*=|javascript:|<svg|<iframe)" \
    "t:none,t:urlDecodeUni"