Vendor
An authorization bypass vulnerability in AcyMailing allows authenticated subscribers to hijack WordPress password reset emails by modifying notification template BCC fields.