{
 "id": "WPSEC-2026-3078",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3078/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3078/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3078/index.md",
 "title": "AcyMailing < 11.1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference to Subscription Modification via 'user_id' Parameter",
 "description": "The AcyMailing plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 11.1.1. This is due to the unsubscribe page actions accepting any logged-in user as identified and then loading the subscriber to modify from a user-supplied ID, without checking that subscriber's key. This makes it possible for authenticated attackers, with subscriber-level access and above, to subscribe other subscribers to, or unsubscribe them from, mailing lists.",
 "plugin": {
  "slug": "acymailing",
  "name": "AcyMailing",
  "full_name": "AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/acymailing/",
  "advisories_url": "https://wpsec.com/vuln/plugin/acymailing/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/acymailing"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "11.1.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 11.1.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "11.1.2",
 "remediation": "Update to 11.1.2 or later.",
 "fix_released": "2026-11-12T13:34:29+00:00",
 "published": "2026-11-13T13:41:21+00:00",
 "updated": "2026-11-12T17:16:02.438322+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3078/",
  "https://plugins.svn.wordpress.org/acymailing/tags/11.1.2/",
  "https://wordpress.org/plugins/acymailing/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/acymailing",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-13"
 }
}