AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress has 15 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 15 are fixed as of September 2026. Their average CVSS score is 6.9, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 8 high. 2026 was the busiest year with 11 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (33%). Other recurring categories include Missing Authorization, SQL Injection.

Every one of the 15 issues recorded for AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress has a vendor fix available, so running the current release closes all known holes.

13 independent researchers contributed these findings, most of them (2) reported by Asim Alshaya. AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891023.11.2018Today29.04.20216.1AcyMailing SMTP Newsletter < 7.5.0 - Open Redirect CVSS 6.1 · 29.04.202105.09.20236.1AcyMailing SMTP Newsletter <= 8.6.2 - Reflected Cross-Site Scripting CVSS 6.1 · 05.09.202321.08.20247.5AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function CVSS 7.5 · 21.08.202430.12.20246.1AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 9.11.0 - Reflected Cross-Site Scripting CVSS 6.1 · 30.12.202415.04.20268.8AcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation CVSS 8.8 · 15.04.202619.05.20268.8AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router' CVSS 8.8 · 19.05.202606.07.20267.2AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated Stored Cross-Site Scripting CVSS 7.2 · 06.07.20267.5AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated SQL Injection CVSS 7.5 · 06.07.20264.3AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.1 - Missing Authorization CVSS 4.3 · 06.07.202608.07.20266.4AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute CVSS 6.4 · 08.07.202606.08.20267.5AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress < 10.11.1 - Unauthenticated SQL Injection CVSS 7.5 · 06.08.202611.08.20268.8AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update CVSS 8.8 · 11.08.202613.08.20264.3AcyMailing SMTP Newsletter <= 10.11.1 - Missing Authorization CVSS 4.3 · 13.08.20266.4AcyMailing SMTP Newsletter <= 10.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 13.08.202610.09.20267.5AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter CVSS 7.5 · 10.09.2026

Strategic Overview

Avg CVSSMedium
6.9/ 10
Patch Coverage100%
Open

0

Fixed

15

Get automatic notifications for all AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2026-15426

AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update

Read the full analysis

Vulnerability Records

15 records
2026-09-10 11:10CVE-2026-77807
7.5
High
darooYes
2026-08-13 00:00CVE-2026-28181
4.3
Medium
Asim AlshayaYes
2026-08-13 00:00CVE-2026-28182
6.4
Medium
Asim AlshayaYes
2026-08-11 06:12CVE-2026-15426
8.8
High
d.v4n_s3cYes
2026-08-06 00:00CVE-2026-14920
7.5
High
Pedro PinhoYes
2026-07-08 18:04CVE-2026-12170
6.4
Medium
Chloe ChamberlandYes
2026-07-06 00:00CVE-2026-57741
7.2
High
darooYes
2026-07-06 00:00CVE-2026-57739
7.5
High
kai63001Yes
2026-07-06 00:00CVE-2026-57740
4.3
Medium
anhcd05Yes
2026-05-19 18:19CVE-2026-5200
8.8
High
Azril Fathoni (kiseki)Yes
Showing 1–10 of 15 reports
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress banner
Latestv11.0.5

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

AcyMailing Newsletter Team

Author

AcyMailing Newsletter Team

4.8(157)
96/100
Last Updated
2026-09-03 (10d ago)
Active Installs
6,000+
Downloads
238,402
Requires WP
5.8+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2018-11-23 (8y ago)

💌 UNLEASH THE POWER OF EMAIL MARKETING AUTOMATION: Effortlessly create attention-grabbing newsletters with our intuitive drag-and-drop editor – no HTML skills required. Automate your newsletter formation process using pre-saved zones. Seamlessly include your WordPress articles in your newsletters. Personalize your newsletters with user data such as name, email, or custom fields. Implement social media share options for Twitter, Facebook, and LinkedIn to expand your reach. Experience mobile-responsive default templates with previews for desktop and mobile versions. 📊 TAKE YOUR EMAIL MARKETING TO THE NEXT LEVEL: Conduct automated mass actions on users, including sending birthday newsletters, welcome greetings, and more. Plan follow-up newsletter sequences based on user interaction to nurture and engage your audience. Effortlessly schedule your newsletters for timely delivery. Automatically send timely reminders to recover abandoned WooCommerce shopping carts. Create and duplicate marketing automation workflows with ease. Handle bounce emails efficiently for improved deliverability. 📥 ENHANCE DELIVERABILITY AND ENSURE GDPR COMPLIANCE: Effectively dispatch emails in real-time using our queue system. Follow recommendations from our analysis tool to optimize your deliverability. Track reliable statistics to gain insights into your newsletter performance. 👤 EFFICIENT CONTACT LIST MANAGEMENT WITH GDPR COMPLIANCE: Effortlessly manage your subscribers with AcyMailing. Import users seamlessly from any platform or source. Utilize efficient filter options to target specific user segments. Automatically subscribe users during registration for streamlined list management. Handle false email addresses and integrate strong captchas for enhanced data security. ⤵️ EXPLORING MORE WITH ACYMAILING: Enjoy various integrations available: Business Directory, Contact Form 7, Easy Digital Downloads, Gravity Forms, Zapier, Make.com, WooCommerce, The Events Calendar, etc… Experience the power of AcyMailing with our demo site. Leverage diverse external sending services – AcyMailing Sending Service, Brevo/Sendinblue, Mailgun, SendGrid, Amazon SES, SMTP and more. 🔎Stay tuned to know every update on our plugins. Follow us on LinkedIn, Twitter, Facebook, or our website.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C