An authorization bypass vulnerability in the AcyMailing WordPress plugin allows authenticated low-privileged users to perform unauthorized actions, potentially leading to full control over plugin features.

This is an improper privilege management vulnerability (CWE-269) that permits authenticated users with low privileges to bypass authorization checks, enabling them to execute sensitive functions within the plugin.

By exploiting this flaw, an attacker could manipulate marketing automation settings, access subscriber data, or potentially alter newsletter content. With a CVSS score of 8.8, the vulnerability poses a substantial risk of unauthorized data access and integrity loss within the WordPress environment.

Immediate Action: Update the AcyMailing plugin to version 11.0.0 or later immediately.

Proactive Monitoring: Review audit logs for unexpected configuration changes or unauthorized access to the AcyMailing dashboard by non-administrative users.

Compensating Controls: If an immediate update is not feasible, restrict access to the WordPress administrative dashboard and plugin settings via IP-based access control or WAF rules.

Public Exploit Available: No (unknown)

Given the ease of exploitation for authenticated users, administrators must treat this as a critical update. Verify your plugin version and apply the patch to version 11.0.0 immediately to prevent unauthorized privilege escalation.