The AcyMailing WordPress plugin suffers from an unrestricted file upload vulnerability (CWE-434) in the acym_extractArchive function. Authenticated users with low privileges (Subscriber and above) can upload arbitrary files because the plugin fails to validate file types properly. This can lead to remote code execution if malicious files are uploaded and executed on the server. The vulnerability affects all versions up to and including 9.7.2. The CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor.

An attacker with Subscriber-level access or higher can upload arbitrary files to the server hosting the vulnerable AcyMailing plugin. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability poses a high risk to affected WordPress sites using this plugin version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles that can upload files or disable the plugin if possible. Monitor for updates from the vendor and apply patches promptly once available.