{
 "id": "WPSEC-2026-3076",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3076/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3076/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3076/index.md",
 "title": "AcyMailing < 11.1.2 - Unauthenticated Missing Authorization to Subscriber Unsubscription",
 "description": "The AcyMailing plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 11.1.1. This is due to the unsubscribe handler and the subscription form acting on the subscriber matching a submitted email address without verifying that the requester owns that address, unless subscriber data modifications without authentication were disabled. This makes it possible for unauthenticated attackers to unsubscribe any subscriber whose email address they know from mailing lists.",
 "plugin": {
  "slug": "acymailing",
  "name": "AcyMailing",
  "full_name": "AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/acymailing/",
  "advisories_url": "https://wpsec.com/vuln/plugin/acymailing/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/acymailing"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "11.1.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 11.1.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "11.1.2",
 "remediation": "Update to 11.1.2 or later.",
 "fix_released": "2026-11-12T13:34:29+00:00",
 "published": "2026-11-13T13:41:21+00:00",
 "updated": "2026-11-12T17:16:02.438322+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3076/",
  "https://plugins.svn.wordpress.org/acymailing/tags/11.1.2/",
  "https://wordpress.org/plugins/acymailing/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/acymailing",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-13"
 }
}