CVE-2026-3614: AcyMailing Privilege Escalation Vulnerability

CVE-2026-3614 Overview

The AcyMailing plugin for WordPress contains a privilege escalation vulnerability affecting versions 9.11.0 through 10.8.1. The vulnerability exists due to a missing capability check on the wp_ajax_acymailing_router AJAX handler. Authenticated attackers with Subscriber-level access can exploit this flaw to access admin-only controllers, enable the autologin feature, create malicious newsletter subscribers with injected cms_id values pointing to any WordPress user, and subsequently use the autologin URL to authenticate as that user—including administrators.

Critical Impact

Authenticated attackers with minimal subscriber privileges can escalate to full administrative access, potentially leading to complete WordPress site compromise.

Affected Products

• AcyMailing WordPress Plugin versions 9.11.0 through 10.8.1

Discovery Timeline

• April 16, 2026 - CVE CVE-2026-3614 published to NVD
• April 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3614

Vulnerability Analysis

This vulnerability is classified as CWE-862: Missing Authorization. The core issue stems from the AcyMailing plugin's failure to properly verify user capabilities before processing administrative AJAX requests. The wp_ajax_acymailing_router handler processes requests from authenticated users without validating whether the requesting user has appropriate administrative permissions.

The attack chain involves multiple steps: first, accessing configuration management controllers that should be restricted to administrators; second, enabling the autologin feature within the plugin; third, creating a malicious newsletter subscriber record with a crafted cms_id field that references an existing WordPress user (such as an administrator); and finally, utilizing the generated autologin URL to authenticate as the targeted user.

The vulnerability is exploitable over the network and requires low attack complexity. While authentication is required, only subscriber-level access is needed—the lowest tier of WordPress authenticated users. No user interaction is required to exploit this vulnerability.

Root Cause

The root cause of CVE-2026-3614 is the absence of capability checks within the Router.php file's AJAX handler implementation. The vulnerable code in WpInit/Router.php processes incoming AJAX requests and routes them to various controllers without first verifying that the authenticated user possesses the required WordPress capabilities (such as manage_options for administrative functions).

The AcymController.php backend controller lacks proper authorization gates at both lines 92 and 99 (in versions 10.7.1 and 10.8.1 respectively), allowing subscribers to invoke methods intended exclusively for administrators.

Attack Vector

The attack leverages the network-accessible WordPress AJAX endpoint. An attacker with a valid subscriber account can send crafted POST requests to wp-admin/admin-ajax.php with the action parameter set to acymailing_router. By manipulating the controller and task parameters, the attacker can:

1. Access the configuration controller to enable autologin functionality
2. Create or modify subscriber records with arbitrary cms_id values
3. Generate autologin tokens associated with administrator user IDs
4. Use the autologin URL to bypass authentication and access the WordPress admin panel as the targeted user

The vulnerability does not require any special tools—standard HTTP requests to the WordPress AJAX endpoint are sufficient to exploit this flaw.

Detection Methods for CVE-2026-3614

Indicators of Compromise

• Unexpected changes to AcyMailing plugin configuration, particularly the autologin feature being enabled without administrator action
• Anomalous subscriber records containing cms_id values that reference administrator or high-privilege user accounts
• Unusual AJAX requests to wp_ajax_acymailing_router originating from subscriber-level accounts
• Unexplained administrator logins via AcyMailing autologin URLs

Detection Strategies

• Monitor WordPress AJAX requests for action=acymailing_router calls that access sensitive controllers from low-privilege users
• Implement logging for AcyMailing configuration changes and cross-reference with actual administrator activity
• Review subscriber database entries for suspicious cms_id field values that don't match the subscriber's own user ID
• Deploy Web Application Firewall (WAF) rules to detect privilege escalation attempts targeting WordPress plugins

Monitoring Recommendations

• Enable WordPress audit logging for all AJAX requests, particularly those involving plugin-specific actions
• Configure alerts for autologin feature enablement or subscriber record modifications outside of normal administrative workflows
• Regularly audit AcyMailing subscriber records for integrity and unexpected cms_id associations
• Monitor authentication logs for logins via autologin tokens, especially for administrator accounts

How to Mitigate CVE-2026-3614

Immediate Actions Required

• Update AcyMailing plugin to a version newer than 10.8.1 that includes the security patch
• Disable the AcyMailing autologin feature if not required for business operations
• Audit existing subscriber records for suspicious cms_id values and remove any malicious entries
• Review WordPress user accounts for unauthorized privilege changes or new administrator accounts
• Consider temporarily deactivating the AcyMailing plugin until a patched version can be deployed

Patch Information

Organizations should update to the latest version of AcyMailing that addresses this missing authorization vulnerability. Refer to the Wordfence Vulnerability Report for the latest patch information and vendor guidance. The fix implements proper capability checks within the AJAX router to ensure only users with appropriate permissions can access administrative controllers.

Workarounds

• Implement server-level access controls to restrict AJAX requests to the AcyMailing router endpoint
• Use a Web Application Firewall to block suspicious requests targeting wp_ajax_acymailing_router
• Limit subscriber registration to reduce the pool of potentially malicious authenticated users
• Add custom capability checks via WordPress hooks if technical resources are available to implement a temporary fix

# Example: Restrict AcyMailing AJAX access via .htaccess (temporary measure)
# Add to WordPress .htaccess file

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$ [NC]
    RewriteCond %{QUERY_STRING} action=acymailing_router [NC]
    RewriteCond %{HTTP_COOKIE} !wordpress_logged_in.*admin [NC]
    RewriteRule .* - [F,L]
</IfModule>