Vulnerabilities / AcyMailing / WPSEC-2026-3077
AcyMailing < 11.1.2 - Unauthenticated Sensitive Information Exposure via Campaign Online Version
Medium 5.3
CWE-200Fixed in 11.1.2
- ID
- WPSEC-2026-3077
- Plugin
- AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress (acymailing)
- Affected
- all versions before 11.1.2
- Remediation
- Update to 11.1.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- AcyMailing on WPSec AttackSurface
- Fix released
- Published
Description
The AcyMailing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.1. This is due to the online version view returning the archived copy of any sent campaign before checking whether the visitor may view it, and trusting a subscriber's test-send history before verifying the subscriber key. This makes it possible for unauthenticated attackers to read campaigns that were unpublished after sending or sent only to a restricted audience, and test emails of unsent campaigns.
References
- https://wpsec.com/vuln/WPSEC-2026-3077/
- https://plugins.svn.wordpress.org/acymailing/tags/11.1.2/
- https://wordpress.org/plugins/acymailing/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS