Introduction
A missing authorization check in the AcyMailing WordPress plugin lets any authenticated user with Subscriber-level access chain configuration tampering and secret key exfiltration into a full administrator account takeover. With over 7,000 active installations and a CVSS score of 8.8, the flaw is a meaningful risk for WordPress sites that rely on AcyMailing for newsletters and marketing automation.
The AcyMailing Newsletter Team develops the plugin, which provides drag-and-drop email editing, automated newsletter workflows, and subscriber data personalization. It is a self-hosted alternative to SaaS email marketing platforms, which makes it popular with organizations that want to keep their mailing list data on their own infrastructure. The same positioning means a compromise of the plugin can expose both the WordPress admin panel and the subscriber data it manages.
Technical information
CVE-2026-5200 is classified under CWE-862 (Missing Authorization). The flaw is in the acymailing_router component, which handles incoming requests and dispatches them to plugin functions. The router does not run adequate capability checks before it executes privileged operations, so it processes a request from a Subscriber with the same trust as a request from an Administrator.
The CVSS 3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is exploitable over the network with low complexity, requires only low privileges (a valid Subscriber account), needs no user interaction, and scores high on all three impact dimensions: confidentiality, integrity, and availability.
Attack flow
Exploitation is a chained attack in four stages:
-
Obtain Subscriber access. The attacker registers a new account on a WordPress site that allows open registration, or uses an existing Subscriber-level account. This is the only prerequisite.
-
Modify privileged AcyMailing configuration. The attacker sends crafted requests to the
acymailing_routerendpoint. The router does not properly verify authorization, so it accepts and executes these configuration changes regardless of the caller's actual WordPress role. -
Export subscriber secret keys. Through the same authorization gap, the attacker extracts the secret keys tied to subscriber records. AcyMailing uses these keys internally in its authentication and session management logic.
-
Chain into administrator takeover. If the attacker knows a site administrator's email address, which is frequently discoverable through WordPress author pages, public comments, or simple enumeration, they can combine the modified configuration with the exported secret keys to impersonate the administrator and gain full control of the WordPress site.
Patch details
The fix shipped in version 10.9.0, a large release that touched 170 files. The security-relevant changes are concentrated in two files: WpInit/Router.php, which handles request routing, and back/Core/wordpress/security.php, which enforces access control. A follow-up release, version 10.9.1 (released April 29, 2026), corrected further issues where the new access controls were too restrictive and stopped some legitimate features from working correctly based on access rights.
Affected systems and versions
All versions of the AcyMailing WordPress plugin up to and including version 10.8.2 are vulnerable. The fix is available from version 10.9.0, but version 10.9.1 is the preferred update target because the first patch release had access control regressions.
| Detail | Value |
|---|---|
| Vulnerable versions | All versions through 10.8.2 |
| Fixed in | 10.9.0 (10.9.1 recommended) |
| Active installations | Over 7,000 |
| Required attacker privilege | Subscriber (or any authenticated role) |
Any WordPress site running AcyMailing with open user registration enabled is at elevated risk, because the only prerequisite for exploitation is a valid authenticated session at the Subscriber level.
Vendor security history
CVE-2026-5200 was disclosed just weeks after CVE-2026-3614, a structurally similar vulnerability published on April 16, 2026. That earlier flaw affected AcyMailing versions 9.11.0 through 10.8.1 and also came from a missing capability check on the AJAX router. Its exploitation path used the autologin feature to escalate from Subscriber to Administrator.
The same vulnerability class (missing authorization in the router) showing up twice in quick succession suggests a systemic issue with how AcyMailing implements access control around its request dispatching logic, rather than a one-off coding error. The pattern indicates that the router's architecture may not enforce capability checks by default, which leaves each endpoint responsible for its own authorization. That design is prone to exactly this type of oversight.
