AcyMailing < 11.1.2 - Unauthenticated Sensitive Information Exposure via Subscription User Tags
- ID
- WPSEC-2026-3075
- Plugin
- AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress (acymailing)
- Affected
- all versions before 11.1.2
- Remediation
- Update to 11.1.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- AcyMailing on WPSec AttackSurface
- Fix released
- Published
Description
The AcyMailing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.1. This is due to the subscription handler filling the {user:*} tags of the subscription message and the redirect URL with every stored property of the subscriber matching the submitted email address, without verifying that the requester is that subscriber. This makes it possible for unauthenticated attackers to read the stored data of a subscriber whose email address they know, including the secret subscriber key, which can then be used to manage that subscriber's subscriptions and profile.
References
- https://wpsec.com/vuln/WPSEC-2026-3075/
- https://plugins.svn.wordpress.org/acymailing/tags/11.1.2/
- https://wordpress.org/plugins/acymailing/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS