CVE-2026-15426: AcyMailing Auth Bypass Vulnerability

CVE-2026-15426 Overview

CVE-2026-15426 is an authorization bypass vulnerability in the AcyMailing newsletter and marketing automation plugin for WordPress, affecting all versions up to and including 10.11.1. The plugin fails to verify that a user is authorized to modify notification templates. Authenticated attackers with subscriber-level access can overwrite the BCC field of the acy_notification_cms template. Once modified, WordPress password-reset emails — including those sent to administrators — are silently copied to an attacker-controlled address, enabling account takeover through the captured reset link. Exploitation requires the site administrator to have enabled the "Send website emails with AcyMailing" option, which routes WordPress core notifications through the plugin's templating system.

Critical Impact
Subscriber-level accounts can silently intercept administrator password-reset emails, leading to full WordPress site takeover.

Affected Products

AcyMailing plugin for WordPress, all versions ≤ 10.11.1
WordPress sites with "Send website emails with AcyMailing" enabled
Administrator accounts on affected installations (targets for takeover)

Discovery Timeline

2026-08-11 - CVE-2026-15426 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-15426

Vulnerability Analysis

The flaw is an authorization bypass classified under [CWE-269: Improper Privilege Management]. AcyMailing exposes notification-template editing endpoints without confirming that the requesting user holds the capabilities required to modify plugin templates. A subscriber — the lowest-privileged authenticated WordPress role — can submit a request that updates the acy_notification_cms template used for outbound notifications.

By injecting a value into the BCC field, the attacker turns the template into a mail-interception primitive. When any WordPress user, including an administrator, initiates a password reset, the reset email is generated with the tampered BCC header intact. The attacker receives a copy containing the one-time reset link and can complete the reset before the legitimate user acts. The result is a network-exploitable path from subscriber access to full administrative compromise.

Root Cause

The plugin's controllers that handle template edits — including logic reachable through Controllers/Mails/Edition.php and Core/AcymController.php — do not enforce a capability check equivalent to manage_options before persisting changes. Any authenticated session routed through the plugin's front-controller can reach the update path. The WordPress code review references show the affected controller entry points.

Attack Vector

An attacker registers or uses an existing subscriber account. They then send an authenticated request to the AcyMailing template edit endpoint, setting the BCC field of the acy_notification_cms template to an address they control. The attacker triggers the WordPress "lost password" flow for an administrator username or email. Because AcyMailing is configured to route WordPress core mail, the outbound reset message inherits the injected BCC and is silently copied to the attacker. The attacker follows the reset link, sets a new administrator password, and takes over the site. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-15426

Indicators of Compromise

Unexpected values in the BCC field of the acy_notification_cms notification template, especially external email domains.
Password-reset emails delivered to administrators shortly after low-privilege subscriber activity.
Subscriber accounts issuing authenticated POST requests to AcyMailing edition or dashboard controller endpoints.
New administrator password changes not initiated from known admin IP addresses or sessions.

Detection Strategies

Audit the AcyMailing template configuration in the database and flag any BCC/CC recipients outside the organization's allowlist.
Correlate WordPress retrieve_password events with outbound SMTP logs to identify silent recipients beyond the intended user.
Alert on HTTP requests to AcyMailing controller routes from users whose WordPress role is subscriber or contributor.
Review the WordPress changeset 3632690 to identify the specific endpoints that require monitoring pre-patch.

Monitoring Recommendations

Enable WordPress audit logging for template changes and user role events, then forward logs to a centralized SIEM.
Monitor mail-server headers for unexpected BCC recipients on system-generated messages such as password resets.
Track short-interval sequences of subscriber login, template edit, and password-reset request from the same IP or session.

How to Mitigate CVE-2026-15426

Immediate Actions Required

Update the AcyMailing plugin to a version later than 10.11.1 that includes the fix from changeset 3632690.
If patching is not immediately possible, disable the "Send website emails with AcyMailing" option so WordPress core mail no longer routes through the plugin.
Inspect the acy_notification_cms template and remove any unauthorized BCC or CC entries.
Force a password reset for all administrator accounts and review recent admin logins for signs of takeover.

Patch Information

The vendor addressed the authorization bypass in the AcyMailing plugin repository via WordPress plugin changeset 3632690. Site owners should upgrade to the fixed release available through the WordPress plugin directory. Details of the code fix are visible in the WordPress changeset 3632690 and the underlying controllers referenced in the MailClass source.

Workarounds

Disable the AcyMailing plugin entirely until the update can be applied.
Restrict user registration or set the default new-user role to something other than subscriber on high-value sites.
Enforce multi-factor authentication for administrator accounts so a captured reset link alone cannot complete takeover.
Configure the mail transport to strip or alert on BCC headers added by CMS-generated templates.

bash

# Configuration example: disable AcyMailing routing of WordPress core mail via WP-CLI
wp option patch update acymailing_config send_wp_mail 0

# Verify current setting
wp option get acymailing_config --format=json | jq '.send_wp_mail'

# Optional: deactivate the plugin until patched
wp plugin deactivate acymailing