WordPress Plugin Flaw Lets Subscribers Hijack Admin Accounts

Shimi’s Cyber World has learned that the AcyMailing plugin for WordPress harbors a critical privilege escalation vulnerability. According to the National Vulnerability Database, all versions from 9.11.0 up to and including 10.8.1 are affected by a missing capability check in the wp_ajax_acymailing_router AJAX handler.

This oversight is serious. It allows authenticated attackers, even those with basic Subscriber-level access, to bypass intended restrictions. The National Vulnerability Database notes that attackers can exploit this to access administrator-only controllers, enabling them to modify plugin configurations. Furthermore, they can activate the autologin feature, provision a new subscriber with a specially crafted cms_id that targets any WordPress user, and then use a generated autologin URL to impersonate that user, including administrators.