The AcyMailing plugin for WordPress suffers from a missing capability check in the `wp_ajax_acymailing_router` AJAX handler across versions 9.11.0 to 10.8.1. This allows authenticated users with low privileges (Subscriber and above) to escalate their privileges by accessing admin-only controllers, enabling autologin, and creating newsletter subscribers with injected user IDs. Attackers can then use the autologin feature to authenticate as any WordPress user, including administrators, effectively bypassing intended access controls. The vulnerability is tracked as CVE-2026-3614 and is classified under CWE-862 (Missing Authorization).

Successful exploitation allows an authenticated low-privilege user to gain administrative access to the WordPress site by abusing the autologin feature and manipulating subscriber records. This compromises confidentiality, integrity, and availability of the affected system, enabling full control over the WordPress environment. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the AcyMailing plugin and consider disabling or limiting AJAX handler access for low-privilege users as a temporary mitigation. Monitor for updates from the vendor and apply patches promptly once available.