CVE-2026-77807: AcyMailing WordPress Path Traversal Flaw

CVE-2026-77807 Overview

The AcyMailing newsletter and marketing automation plugin for WordPress contains a directory traversal vulnerability affecting all versions up to and including 11.0.4. Unauthenticated attackers can exploit the user[name] parameter to read arbitrary files on the underlying server. The flaw is categorized under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory. Successful exploitation requires the "Embed images" option to be enabled in the AcyMailing configuration. Attackers can retrieve sensitive server files, including configuration files containing database credentials and API secrets.

Critical Impact
Unauthenticated attackers can read arbitrary files on WordPress servers running AcyMailing 11.0.4 or earlier when the "Embed images" option is enabled, exposing configuration secrets and credentials.

Affected Products

AcyMailing plugin for WordPress, all versions up to and including 11.0.4
WordPress sites with the "Embed images" option enabled in AcyMailing configuration
Any hosting environment where the plugin process has read access to sensitive files

Discovery Timeline

2026-09-11 - CVE-2026-77807 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-77807

Vulnerability Analysis

The vulnerability resides in how the AcyMailing plugin processes the user[name] parameter when embedding images in outbound content. The plugin passes attacker-controlled input into file read operations without sanitizing path traversal sequences such as ../. When the "Embed images" feature is active, the plugin resolves user-supplied values as file paths and returns the file contents in the resulting response or embedded payload.

Because the endpoint accepts unauthenticated requests, exploitation does not require account credentials or user interaction. The impact is bounded to confidentiality: attackers gain read access to any file the PHP process can access, but cannot directly write files or execute code through this flaw. Retrieved files commonly include wp-config.php, which discloses database credentials and secret keys that enable follow-on attacks.

Root Cause

The root cause is missing input validation on the user[name] parameter. The plugin concatenates the parameter value into a file path used for image embedding without normalizing the path or restricting it to an allowed base directory. This permits path traversal sequences to escape the intended image directory and reference arbitrary filesystem locations.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request containing traversal sequences in the user[name] parameter to a vulnerable AcyMailing endpoint. The plugin resolves the path and returns file contents. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Changeset for technical details on the vulnerable code path.

Detection Methods for CVE-2026-77807

Indicators of Compromise

HTTP requests to AcyMailing endpoints containing user[name] parameter values with ../ sequences or absolute file paths
Web server access logs showing unauthenticated requests referencing wp-config.php, /etc/passwd, or similar sensitive filenames
Unexpected outbound email or image-embed activity originating from the AcyMailing plugin

Detection Strategies

Inspect web application firewall (WAF) logs for path traversal patterns in query strings and POST bodies targeting AcyMailing routes
Audit the AcyMailing configuration to identify sites where the "Embed images" option is enabled, which represents the exploitable configuration
Correlate access log entries with plugin version data to prioritize hosts running 11.0.4 or earlier

Monitoring Recommendations

Alert on HTTP requests where the user[name] parameter contains encoded or literal traversal characters such as %2e%2e%2f or ../
Monitor file system reads by the web server process for access to files outside the WordPress uploads directory
Track responses that return unusually large payloads or content types inconsistent with expected image data

How to Mitigate CVE-2026-77807

Immediate Actions Required

Update the AcyMailing plugin to the patched version referenced in the WordPress Plugin Changeset
Disable the "Embed images" option in AcyMailing configuration until the plugin is patched to eliminate the exploitable code path
Rotate WordPress database credentials, secret keys, and any API tokens stored in wp-config.php if exploitation is suspected
Review web server access logs for prior exploitation attempts targeting the user[name] parameter

Patch Information

The vendor addressed the vulnerability in a version released after 11.0.4. The fix is documented in the WordPress Plugin Changeset 3679457. Site administrators should apply the update through the WordPress plugin management interface or via WP-CLI.

Workarounds

Disable the "Embed images" option in AcyMailing to remove the prerequisite for exploitation
Deploy WAF rules that block path traversal patterns in requests targeting AcyMailing endpoints
Restrict file system permissions so the PHP process cannot read sensitive files outside the WordPress web root

bash

# Configuration example
# Update AcyMailing via WP-CLI
wp plugin update acymailing

# Verify installed version
wp plugin get acymailing --field=version