CVE-2026-5200: AcyMailing Auth Bypass Vulnerability

CVE-2026-5200 Overview

CVE-2026-5200 is a Missing Authorization vulnerability [CWE-862] in the AcyMailing newsletter and marketing automation plugin for WordPress. The flaw affects all versions up to and including 10.8.2. The plugin fails to verify whether a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can modify privileged AcyMailing configuration and export subscriber secret keys. When the target administrator email address is known, attackers can chain these actions into a full administrator account takeover.

Critical Impact
Subscriber-level authenticated users can escalate privileges to full administrator account takeover on affected WordPress sites running AcyMailing.

Affected Products

AcyMailing plugin for WordPress versions up to and including 10.8.2
WordPress installations using AcyMailing for newsletter and marketing automation
Sites with open subscriber registration enabled are at increased risk

Discovery Timeline

2026-05-20 - CVE-2026-5200 published to NVD
2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-5200

Vulnerability Analysis

The AcyMailing plugin exposes administrative actions through endpoints that do not enforce capability checks. Authenticated users with subscriber privileges can invoke these actions and modify plugin configuration intended for administrators. The vulnerability is classified under CWE-862: Missing Authorization.

The impact extends beyond configuration tampering. Attackers can export subscriber secret keys through the same authorization gap. These secret keys enable account-level operations for any subscriber, including administrators enrolled in the mailing list. When an attacker knows an administrator's email address, the chained exploitation results in administrator account takeover.

Network-based exploitation requires only low-privilege authentication and no user interaction. The attack delivers high impact to confidentiality, integrity, and availability of the WordPress site.

Root Cause

The root cause is the absence of authorization checks on privileged AcyMailing actions. The plugin authenticates the request but does not verify the user holds the required WordPress capability or role. Subscriber accounts, which can be created through self-registration on many WordPress sites, satisfy the authentication requirement and reach the vulnerable code paths.

Attack Vector

An attacker registers or uses an existing subscriber-level account on the target WordPress site. The attacker sends crafted requests to AcyMailing action handlers to alter configuration or export subscriber secret keys. With the administrator's email and the exported secret material, the attacker performs the account takeover. Refer to the WordPress AcyMailing Change Log and Wordfence Vulnerability ID f8470662 for technical details.

Detection Methods for CVE-2026-5200

Indicators of Compromise

Unexpected modifications to AcyMailing plugin configuration or sender profiles
Requests to AcyMailing AJAX or REST action endpoints originating from subscriber-level accounts
Export or read activity targeting subscriber secret key fields in the AcyMailing database tables
New or modified WordPress administrator accounts shortly after AcyMailing activity

Detection Strategies

Review WordPress access logs for admin-ajax.php requests carrying AcyMailing action parameters from low-privilege sessions
Audit user role changes and administrator additions correlated with AcyMailing API calls
Inspect database audit trails for reads against AcyMailing subscriber key columns
Monitor outbound mailing activity for configuration changes that redirect mail delivery

Monitoring Recommendations

Enable WordPress audit logging plugins to capture role assignments and option changes
Forward web server and PHP error logs to a centralized SIEM for correlation
Alert on subscriber accounts performing administrative-style requests
Track plugin version inventory across WordPress estates to identify hosts still on 10.8.2 or earlier

How to Mitigate CVE-2026-5200

Immediate Actions Required

Update the AcyMailing plugin to the version released after changeset 3516422 on the WordPress plugin repository
Audit existing WordPress administrator accounts and revoke any that are not recognized
Rotate administrator passwords and force re-authentication for all privileged accounts
Review AcyMailing configuration for unauthorized changes to sender profiles and integrations

Patch Information

The fix is published in the AcyMailing source tree under changeset 3516422. Site administrators should upgrade beyond version 10.8.2 using the WordPress plugin updater. See the WordPress AcyMailing Change Log for the committed changes.

Workarounds

Disable open user registration in WordPress settings until the plugin is patched
Deactivate the AcyMailing plugin on affected sites if an immediate update is not possible
Apply a web application firewall rule that blocks AcyMailing action requests from non-administrator sessions
Restrict access to WordPress administrative endpoints by IP allowlisting where feasible

bash

# Example: disable WordPress user registration via wp-cli
wp option update users_can_register 0

# Deactivate the AcyMailing plugin until patched
wp plugin deactivate acymailing

# Update AcyMailing once the patched version is available
wp plugin update acymailing