{
 "id": "WPSEC-2026-3077",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3077/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3077/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3077/index.md",
 "title": "AcyMailing < 11.1.2 - Unauthenticated Sensitive Information Exposure via Campaign Online Version",
 "description": "The AcyMailing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.1. This is due to the online version view returning the archived copy of any sent campaign before checking whether the visitor may view it, and trusting a subscriber's test-send history before verifying the subscriber key. This makes it possible for unauthenticated attackers to read campaigns that were unpublished after sending or sent only to a restricted audience, and test emails of unsent campaigns.",
 "plugin": {
  "slug": "acymailing",
  "name": "AcyMailing",
  "full_name": "AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/acymailing/",
  "advisories_url": "https://wpsec.com/vuln/plugin/acymailing/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/acymailing"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "11.1.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 11.1.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "11.1.2",
 "remediation": "Update to 11.1.2 or later.",
 "fix_released": "2026-11-12T13:34:29+00:00",
 "published": "2026-11-13T13:41:21+00:00",
 "updated": "2026-11-12T17:16:02.438322+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3077/",
  "https://plugins.svn.wordpress.org/acymailing/tags/11.1.2/",
  "https://wordpress.org/plugins/acymailing/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/acymailing",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-13"
 }
}