The AcyMailing WordPress plugin suffers from a missing authorization vulnerability (CWE-862) in versions up to and including 10.8.2. This flaw allows authenticated users with subscriber-level privileges or higher to bypass proper authorization checks, enabling them to alter privileged plugin settings and export sensitive subscriber secret keys. Exploiting this vulnerability can lead to administrator account takeover when the attacker knows the administrator's email address. The vulnerability is remotely exploitable over the network without user interaction and has a high CVSS score of 8.8. No patch or official fix has been disclosed as of the publication date.

Successful exploitation can lead to full compromise of the WordPress site’s AcyMailing plugin configuration, exposure of subscriber secret keys, and ultimately administrator account takeover. This compromises confidentiality, integrity, and availability of the affected system and its data. The vulnerability requires at least subscriber-level authentication but no user interaction. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to AcyMailing plugin configurations. Avoid exposing administrator email addresses publicly to reduce risk of targeted takeover attempts.