CVE-2026-5200: AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'
Vulnerability summary
CVE-2026-5200 is a high (CVSS 8.8) Missing Authorization vulnerability in acyba acymailing – an ultimate newsletter plugin and marketing automation solution for wordpress. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.3% of scored vulnerabilities. Fixed in 10.9.0.
Timeline
- 20-05-2026PublishedVulnerability first disclosed.
- 20-05-2026Last modifiedVulnerability information updated.
Description
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 10.8.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify privileged AcyMailing configuration, export subscriber secret keys, and chain these actions into administrator account takeover when a target administrator email address is known.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
Increase +0.11 pp
From 0.34% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Acyba1 product
Wordpress1 product
- acymailing≤ 10.8.2 (fixed in 10.9.0)
2 vendors · 2 products