CVE-2026-12170 Overview
CVE-2026-12170 is a Stored Cross-Site Scripting (XSS) vulnerability in the AcyMailing newsletter and marketing automation plugin for WordPress. The flaw affects all versions up to and including 10.10.2. It stems from insufficient input sanitization and output escaping on the alignment attribute processed by the plugin's Gutenberg block and form-rendering code. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any user who views an affected page. The issue is tracked under CWE-79.
Critical Impact
Authenticated contributors can persist JavaScript payloads that execute against site visitors and administrators, enabling session theft, forced admin actions, and defacement.
Affected Products
- AcyMailing plugin for WordPress, all versions through 10.10.2
- WordPress sites permitting contributor-level or higher registrations
- Any site rendering AcyMailing Gutenberg blocks or subscription forms
Discovery Timeline
- 2026-07-09 - CVE-2026-12170 published to the National Vulnerability Database
- 2026-07-09 - Last updated in NVD database
Technical Details for CVE-2026-12170
Vulnerability Analysis
The vulnerability resides in how AcyMailing handles the alignment attribute used by its Gutenberg block and legacy subscription form rendering. The plugin reads the attribute from post content and inline HTML attributes without sufficient sanitization or contextual escaping before echoing it back into the page markup. This allows an attacker to break out of the intended attribute context and inject arbitrary script content.
Contributor-level accounts in WordPress can create posts but cannot publish them directly. Once a higher-privileged user previews or publishes the post, the malicious payload stored on the alignment attribute is rendered against their authenticated session. Because the scope changes from the vulnerable component to the browsing user, the attack impacts a broader trust boundary than the plugin alone.
Root Cause
The defect is a classic failure of the two protections required for user-controlled HTML attributes: input sanitization on save and output escaping on render. The vulnerable paths are documented in the plugin's source at Gutenberg.php line 124, Gutenberg.php line 202, form.php line 292, and form.php line 322. Neither esc_attr() nor equivalent contextual escaping is applied to the alignment value before it reaches the output HTML.
Attack Vector
An attacker authenticates to the target WordPress site with contributor-level access. They insert or modify an AcyMailing block or form, supplying a crafted alignment value that closes the intended attribute and appends a script payload. When an editor, administrator, or site visitor loads the resulting page, the browser parses and executes the injected JavaScript in the site's origin. Typical follow-on actions include exfiltrating session cookies, submitting privileged admin-ajax requests, and creating new administrator accounts.
No verified public exploit code is available. See the Wordfence advisory and the plugin changeset for the vendor fix details.
Detection Methods for CVE-2026-12170
Indicators of Compromise
- Post or page content containing AcyMailing block markup with unusual alignment attribute values, especially strings containing quotes, angle brackets, on* handlers, or javascript: URIs
- New WordPress administrator accounts created shortly after a contributor edited an AcyMailing block or form
- Outbound browser requests from /wp-admin/ sessions to attacker-controlled domains observed in web proxy or DNS logs
- Unexpected changes to the wp_posts table where AcyMailing block attributes contain HTML metacharacters
Detection Strategies
- Audit stored post content for AcyMailing block JSON where the alignment attribute deviates from the expected set of left, center, right, wide, or full
- Correlate contributor-account post edits with subsequent administrator logins and privilege changes
- Review WordPress role and capability change logs following any contributor edit that touched an AcyMailing shortcode or block
Monitoring Recommendations
- Enable file integrity monitoring on the wp-content/plugins/acymailing/ directory
- Ship WordPress audit logs, web server access logs, and admin-ajax activity to a centralized SIEM for correlation
- Alert on responses containing AcyMailing markup that include <script, onerror=, or onload= substrings within attribute contexts
How to Mitigate CVE-2026-12170
Immediate Actions Required
- Update the AcyMailing plugin to a version later than 10.10.2 as soon as the patched release is available from the vendor
- Review and restrict contributor-level and above accounts, removing any that are unused or unrecognized
- Purge site caches and re-scan existing posts and pages for AcyMailing blocks that contain suspicious alignment values
- Rotate WordPress administrator passwords and invalidate active sessions if contributor accounts show signs of abuse
Patch Information
The vendor fix is documented in the AcyMailing plugin changeset 3597432. Site operators should upgrade through the WordPress plugin manager and verify the installed version reports a release higher than 10.10.2. Confirm remediation by reviewing the Wordfence vulnerability report.
Workarounds
- Temporarily disable the AcyMailing plugin on sites that cannot be patched immediately
- Restrict user registration and set the default new-user role to Subscriber to prevent unvetted contributor access
- Deploy a Web Application Firewall rule that blocks requests containing script tags or event-handler attributes in AcyMailing block payloads
- Enforce a strict Content Security Policy that disallows inline scripts on WordPress front-end and admin pages
# Configuration example: disable the plugin via WP-CLI until patched
wp plugin deactivate acymailing
wp user list --role=contributor --fields=ID,user_login,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
