Authorization Bypass in AcyMailing WordPress Plugin

The AcyMailing plugin for WordPress (versions 10.11.1 and earlier) contains an authorization bypass vulnerability (CVE-2026-15426) that allows authenticated users with low-level privileges (subscriber) to modify sensitive email notification templates. If the site administrator has enabled the "Send website emails with AcyMailing" feature, the plugin intercepts WordPress core notification emails and routes them through its internal templating engine.

Attackers exploit this by modifying the BCC field of the 'acy_notification_cms' template. By injecting an attacker-controlled email address into the BCC field, any password-reset request initiated by a site administrator is copied to the attacker. The attacker then intercepts the password-reset link to gain unauthorized access to the administrator account. This vulnerability poses a significant risk to WordPress sites where AcyMailing is configured to handle system-generated emails.

Attack Chain

1. Attacker authenticates to a target WordPress site as a user with 'subscriber' level access or higher.
2. Attacker verifies that the target site has the AcyMailing "Send website emails with AcyMailing" setting enabled.
3. Attacker sends a crafted request to the plugin's configuration endpoint to modify the 'acy_notification_cms' template.
4. Attacker inserts an external email address controlled by the attacker into the BCC parameter of the template.
5. Attacker triggers a legitimate WordPress password-reset request targeting an administrator account (e.g., via /wp-login.php?action=lostpassword).
6. The WordPress backend generates a password-reset notification, which is processed by AcyMailing.
7. AcyMailing appends the attacker's email to the BCC list and dispatches the notification to both the administrator and the attacker.
8. Attacker receives the email containing the password-reset link and completes the account takeover.

Impact

Successful exploitation leads to full administrative account takeover of the affected WordPress site. This grants the attacker elevated privileges, allowing for site-wide data exfiltration, deployment of malicious scripts, or further compromise of the web server hosting environment. All versions up to 10.11.1 are affected.

Recommendation

1. Immediately update the AcyMailing plugin to version 10.11.2 or later to resolve CVE-2026-15426.
2. Audit active WordPress user accounts for suspicious "subscriber" roles that may be involved in testing or exploitation activities.
3. Review webserver logs for unauthorized POST requests directed at AcyMailing configuration endpoints that manage template settings.
4. Temporarily disable the "Send website emails with AcyMailing" feature if an immediate update is not possible.