CVE-2026-77807: AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the user[name] Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires "Embed images" option in AcyMailing configuration being enabled.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it; no WordPress account or other privileges are required. The attacker must be able to reach the affected WordPress site over the network.
Are all affected installations exploitable by default?
No. Exploitation requires the AcyMailing "Embed images" configuration option to be enabled. Installations with that option disabled are not described as exploitable by this issue.
What is the impact if exploitation succeeds?
An attacker can use directory traversal through the user[name] parameter to read arbitrary files from the server. Exposed files may contain sensitive information, while the provided data does not indicate integrity modification or denial-of-service impact.
What can be done if updating is not immediately possible?
Disable the AcyMailing "Embed images" option to remove the stated exploitation prerequisite. Affected versions include all releases up to and including 11.0.4.