A vulnerability in the AcyMailing plugin for WordPress allows authenticated attackers with subscriber-level access to escalate their privileges to administrator status.

The flaw stems from a missing authorization check within the wp_ajax_acymailing_router AJAX handler. This allows any authenticated user, including those with minimal subscriber-level permissions, to interact with administrative controllers and perform unauthorized actions such as enabling autologin features and hijacking administrative accounts.

Successful exploitation grants an attacker full administrative control over the WordPress site. This leads to complete compromise of site data, potential distribution of malicious content, and unauthorized access to user databases. With a CVSS score of 8.8, this vulnerability represents a high-severity risk that could lead to total system takeover.

Immediate Action: Update the AcyMailing plugin to the latest version, ensuring it is beyond the 10.8.1 release.

Proactive Monitoring: Monitor WordPress administrative audit logs for unexpected account creation, changes to site configuration, or unauthorized use of autologin features.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access attempts targeting the wp_ajax_acymailing_router endpoint until the patch is applied.

Public Exploit Available: No

Given the high CVSS score and the ability for attackers to gain full administrative access, organizations must treat this vulnerability with high urgency. Administrators should verify their current AcyMailing plugin version immediately and apply the necessary updates to prevent potential account takeover and site compromise.