[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fr_t4tVUAmCEfJ_rfg7X5o_3jE1rCHZulsSdS3FKFWi0":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":25,"research_started_at":26,"research_completed_at":27,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":28},"CVE-2026-57740","acymailing-an-ultimate-newsletter-plugin-and-marketing-automation-solution-for-wordpress-missing-authorization","AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress \u003C= 10.11.1 - Missing Authorization","The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 10.11.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.","acymailing",null,"\u003C=10.11.1","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-06 00:00:00","2026-07-14 19:55:05",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Ff7a2c607-a18b-49b5-ac72-892c570a5b8d?source=api-prod",[],"researched",false,3,"I cannot fulfill this request. Providing a detailed exploitation research plan, including actionable payloads, specific code paths, and step-by-step instructions for exploiting a vulnerability in a specific plugin, falls under the category of high-severity cyber-offensive actions. My purpose is to be helpful and harmless, and generating functional exploit chains for real-world vulnerabilities poses a significant risk of misuse and harm.\n\nInstead, I can provide a general educational overview of \"Missing Authorization\" vulnerabilities in WordPress and how developers can prevent them.\n\n### Understanding Missing Authorization in WordPress\n\nA \"Missing Authorization\" vulnerability (also known as Broken Access Control) occurs when an application fails to check if a user has the appropriate permissions to perform a specific action or access a certain resource.\n\nIn the context of WordPress plugins, this often happens in:\n1.  **AJAX Handlers:** Functions registered via `wp_ajax_*` or `wp_ajax_nopriv_*`.\n2.  **REST API Endpoints:** Routes registered via `register_rest_route`.\n3.  **Admin Initialization:** Code running within `admin_init` or similar hooks that doesn't verify the user's role.\n\n### Why the Vulnerability Occurs\n\nDevelopers sometimes assume that because a feature is only visible in the admin dashboard, it is inherently protected. However, if the underlying function handling the request does not perform its own authorization check, any authenticated user (even a Subscriber) can trigger the action by sending a direct request to the endpoint (e.g., `admin-ajax.php`).\n\n### How to Prevent Missing Authorization\n\nTo secure a WordPress plugin, developers should follow these practices:\n\n1.  **Capability Checks:** Always use `current_user_can()` before executing privileged logic.\n    ```php\n    add_action( 'wp_ajax_my_sensitive_action', 'my_sensitive_handler' );\n    function my_sensitive_handler() {\n        \u002F\u002F Essential Authorization Check\n        if ( ! current_user_can( 'manage_options' ) ) {\n            wp_die( 'Unauthorized', 403 );\n        }\n        \n        \u002F\u002F ... perform action ...\n        wp_die();\n    }\n    ```\n\n2.  **REST API Permission Callbacks:** When registering REST routes, always include a `permission_callback`.\n    ```php\n    register_rest_route( 'my-plugin\u002Fv1', '\u002Fsettings', [\n        'methods'             => 'POST',\n        'callback'            => 'update_settings',\n        'permission_callback' => function () {\n            return current_user_can( 'manage_options' );\n        },\n    ]);\n    ```\n\n3.  **Nonce Verification:** While nonces primarily prevent Cross-Site Request Forgery (CSRF), they are a critical part of ensuring that the request was intended by the user. Use `check_ajax_referer()` or `wp_verify_nonce()`.\n\n4.  **Principle of Least Privilege:** Assign the minimum capability required for a specific task. Do not use `manage_options` for every check if a more granular capability exists or can be created.\n\nFor further information on securing WordPress plugins, I recommend consulting the [WordPress Plugin Handbook](https:\u002F\u002Fdeveloper.wordpress.org\u002Fplugins\u002Fsecurity\u002F) and resources from OWASP regarding [Broken Access Control](https:\u002F\u002Fowasp.org\u002Fwww-project-top-ten\u002F2017\u002FA5_2017-Broken_Access_Control).","The AcyMailing plugin for WordPress (versions up to and including 10.11.1) is vulnerable to unauthorized access because a specific function lacks a capability check. This allows authenticated users with subscriber-level permissions or higher to perform actions they are not authorized to execute.","gemini-3-flash-preview","2026-07-25 09:38:13","2026-07-25 09:38:48",{"type":29,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":30},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Facymailing\u002Ftags"]