The plugin allows authenticated subscribers to bypass capability checks on the wp_ajax_acymailing_router AJAX handler, enabling access to admin controllers such as configuration management. This flaw permits authenticated attackers with Subscriber-level access or higher to enable the autologin feature, create a malicious subscriber record that references any existing WordPress user via the cms_id field, and then use the autologin URL to log in as that user. The attacker can therefore gain full administrative control, exfiltrate data, modify settings, or deploy further malware. The weakness is a missing authorization check, identified as CWE‑862.

All installations of the AcyMailing WordPress plugin from version 9.11.0 through 10.8.1 are vulnerable. This includes any site using these plugin versions, regardless of hosting environment or customizations, as the error resides in the core router and controller files. The vendor providing the plugin is acyba, known as AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress. Users should verify the installed plugin version and apply an update if their site remains on any of these vulnerable releases.

The CVSS score of 8.8 indicates high severity, and the EPSS score is unavailable, meaning a precise exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog, but the impact remains significant because an attacker with any Subscriber role can escape privileges without needing elevated credentials. The attack requires authenticated access, so it is confined to sites that allow unauthenticated users to log in at least as Subscribers. Once authenticated, the attacker can immediately exploit the missing check to trigger the sequence that builds a malicious subscriber and leverages the autologin link to impersonate higher‑privilege users.