Authorization Bypass Vulnerability in AcyMailing Plugin for WordPress
CVE-2026-15426

8.8HIGH

Key Information:

Vendor

WordPress
Status
Acymailing – An Ultimate Newsletter Plugin And Marketing Automation Solution For WordPress
Vendor
CVE Published:
11 August 2026

What is CVE-2026-15426?

The AcyMailing plugin for WordPress is affected by an authorization bypass vulnerability that allows authenticated users with subscriber-level access and above to manipulate the BCC field of the acy_notification_cms notification template. This flaw enables attackers to reroute WordPress password-reset emails, including those meant for administrators, to their own email addresses. As a result, attackers can obtain reset links and potentially take control of targeted accounts, given that the site administrator has enabled the 'Send website emails with AcyMailing' feature which processes core notifications through AcyMailing's system.

Affected Version(s)

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress 0 <= 10.11.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/acymailing/tag...
https://plugins.trac.wordpress.org/browser/acymailing/tag...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

d.v4n_s3c
.