# AcyMailing < 11.1.2 - Unauthenticated Sensitive Information Exposure via Campaign Online Version

- **ID:** WPSEC-2026-3077
- **Plugin:** AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress (`acymailing`), https://wordpress.org/plugins/acymailing/
- **Affected versions:** all versions before 11.1.2
- **Fixed in:** 11.1.2 (Update to 11.1.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/acymailing
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3077/

## Description

The AcyMailing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.1. This is due to the online version view returning the archived copy of any sent campaign before checking whether the visitor may view it, and trusting a subscriber's test-send history before verifying the subscriber key. This makes it possible for unauthenticated attackers to read campaigns that were unpublished after sending or sent only to a restricted audience, and test emails of unsent campaigns.

## References

- https://wpsec.com/vuln/WPSEC-2026-3077/
- https://plugins.svn.wordpress.org/acymailing/tags/11.1.2/
- https://wordpress.org/plugins/acymailing/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3077/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.