CVE-2026-77807

Name of the Vulnerable Software and Affected Versions AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress versions prior to 11.0.5

Description A Directory Traversal issue exists that allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information. This occurs via the user[name] parameter. Exploitation is possible only if the Embed images option is enabled in the configuration.

Recommendations Update to version 11.0.5 or later. Disable the Embed images option in the AcyMailing configuration as a temporary mitigation measure.