The vulnerability is a missing authorization check in the AcyMailing WordPress plugin up to version 10.8.2, a flaw identified as CWE‑862. An attacker who is already authenticated with at least subscriber-level privileges can exploit the acymailing_router endpoint to alter privileged plugin configuration, export subscriber secret keys, and then chain these actions to compromise an administrator account when the target administrator’s email address is known. The effect is the escalation of privileges to administrator level, allowing full control of the WordPress site and its data.

This issue affects the AcyMailing Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress, versions 10.8.2 and earlier. All installations of these versions are vulnerable to the missing authorization flaw described above.

The CVSS score of 8.8 indicates a high severity with potential for complete compromise of site administration. No EPSS value is available, but the vulnerability can be exploited by any authenticated user with subscriber or higher role; therefore it remains a serious threat. The vulnerability is not listed in the CISA KEV catalog, yet the lack of authorization makes it highly exploitable in typical WordPress deployments.