CVE-2026-15426 is an improper privilege management vulnerability (CWE-269) in the AcyMailing WordPress plugin up to version 10.11.1. The plugin fails to properly verify user authorization when modifying the acy_notification_cms notification template's BCC field. Authenticated attackers with subscriber-level privileges or above can exploit this to cause WordPress password-reset emails, including those for administrator accounts, to be silently BCC'd to an attacker-controlled address. This attack requires the 'Send website emails with AcyMailing' option to be enabled, which routes core WordPress notification emails through AcyMailing's templating system, enabling account takeover via intercepted reset links.

Successful exploitation allows an attacker with low-level authenticated access to intercept password reset emails intended for administrators by silently BCC'ing them to an attacker-controlled address. This can lead to full account takeover of administrator accounts, compromising site security and control. The vulnerability impacts confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the 'Send website emails with AcyMailing' option to prevent routing password reset emails through the vulnerable templating system. Restrict subscriber-level user permissions where possible and monitor for suspicious activity related to password resets.