# AcyMailing < 11.1.2 - Unauthenticated Sensitive Information Exposure via Subscription User Tags

- **ID:** WPSEC-2026-3075
- **Plugin:** AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress (`acymailing`), https://wordpress.org/plugins/acymailing/
- **Affected versions:** all versions before 11.1.2
- **Fixed in:** 11.1.2 (Update to 11.1.2 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/acymailing
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3075/

## Description

The AcyMailing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.1. This is due to the subscription handler filling the {user:*} tags of the subscription message and the redirect URL with every stored property of the subscriber matching the submitted email address, without verifying that the requester is that subscriber. This makes it possible for unauthenticated attackers to read the stored data of a subscriber whose email address they know, including the secret subscriber key, which can then be used to manage that subscriber's subscriptions and profile.

## References

- https://wpsec.com/vuln/WPSEC-2026-3075/
- https://plugins.svn.wordpress.org/acymailing/tags/11.1.2/
- https://wordpress.org/plugins/acymailing/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3075/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.