CVE-2026-15426

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the BCC field of the acy_notification_cms notification template, causing subsequent WordPress password-reset emails — including those targeting administrator accounts — to be silently copied to an attacker-controlled address, enabling account takeover via the captured reset link. Successful exploitation requires the site administrator to have enabled the "Send website emails with AcyMailing" option, which routes WordPress core notification emails through AcyMailing's templating system.

• CWE-269

• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.10.2/back/Classes/MailClass.php#L1496
• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.10.2/back/Controllers/Dashboard/Walkthrough.php#L222
• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.10.2/back/Controllers/Mails/Edition.php#L344
• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.10.2/back/Core/AcymController.php#L99
• https://plugins.trac.wordpress.org/browser/acymailing/tags/10.10.2/back/WpInit/Router.php#L122
• https://plugins.trac.wordpress.org/changeset/3632690/acymailing
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0c187d78-9f1d-4e55-a611-755ee30f855b?source=cve

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15415AWS HealthOmics is a HIPAA-eligible service that fully manag…6.8
• CVE-2026-15416A flaw was identified in Argo CD, the GitOps engine used by …8.9
• CVE-2026-1542The Super Stage WP WordPress plugin through 1.0.1 unserializ…6.5
• CVE-2026-15420The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Webs…4.3
• CVE-2026-15422The illumos SCTP inbound path performs association lookup fo…9.1
• CVE-2026-15425The Yoast SEO – Advanced SEO with real-time guidance and bui…6.4
• CVE-2026-15427An OS command injection vulnerability exists in the TR-069 /…8.1
• CVE-2026-15428An OS command injection vulnerability exists in Archer VX800…8.8
• CVE-2026-15429A privilege escalation vulnerability exists in the HTTP auth…8.8
• CVE-2026-1543The Avada (Fusion) Builder plugin for WordPress is vulnerabl…6.4
• CVE-2026-15430Improper access control in the IRP_MJ_WRITE command interfac…6.2
• CVE-2026-15432When verifying a mac with a ChunkedMacVerification object, T…8.2