PT-2026-89657 · Acyba · Acymailing – An Ultimate Newsletter Plugin/Marketing Automation Solution For Wordpress

Daroo

·

CVE-2026-77807

·

Published

2026-09-10

·

Updated

2026-09-11

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the user[name] Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires "Embed images" option in AcyMailing configuration being enabled.

Fix

Path traversal

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-77807

Affected Products

Acymailing – An Ultimate Newsletter Plugin/Marketing Automation Solution For Wordpress