AcyMailing WordPress Plugin Vulnerable to Admin Takeover (CVE-2026-5200)

The National Vulnerability Database has detailed CVE-2026-5200, a critical missing authorization vulnerability in the AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin. Versions up to and including 10.8.2 are affected. This flaw stems from inadequate authorization checks, allowing authenticated attackers with subscriber-level access or higher to manipulate privileged AcyMailing configurations.

This isn’t just a configuration tweak. Attackers can export subscriber secret keys. Crucially, these actions can be chained to achieve full administrator account takeover if the target administrator’s email address is known. With a CVSS score of 8.8 (HIGH), this vulnerability represents a significant risk, enabling high impact on confidentiality, integrity, and availability.

This is a textbook case of how a seemingly minor authorization bypass can escalate into a full system compromise. The attacker’s calculus is simple: gain a low-privilege foothold, exploit the authorization flaw to elevate, and then pivot to take over the administrator account. For defenders, it means a subscriber account is no longer just a subscriber account; it’s a potential launchpad for a full breach.