AcyMailing WordPress Plugin Missing Authorization Vulnerability Allowing Privilege Escalation

A vulnerability exists in the AcyMailing WordPress plugin, specifically in versions through 10.8.2, due to missing authorization checks. This flaw allows authenticated users with subscriber-level access or higher to manipulate AcyMailing settings, export subscriber secret keys, and potentially take over administrator accounts if the target's email address is known.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in AcyMailing configurations, exposure of subscriber secret keys, and unauthorized access to administrator accounts.

Remediation

Users are advised to update the AcyMailing WordPress plugin to version 10.9.0 or later.