CVE-2026-15426

CVE-2026-15426 is an authenticated privilege escalation in AcyMailing that lets any subscriber-level user modify the notification templates that govern WordPress core emails — including password reset messages. When the 'Send website emails with AcyMailing' feature is enabled (a single admin toggle that routes WordPress emails through the plugin), an authenticated user with subscriber access can modify the acy_notification_cms template to add a BCC address, capturing future password reset tokens and hijacking any account on the site. The CVSS 8.8 score is appropriate for the impact — successful exploitation yields full account takeover. But the deeper problem is architectural: AcyMailing never separated subscriber-level subscription management from administrative email system configuration. The same templating interface that handles user preferences also exposes the system-wide notification templates that WordPress uses for password resets, security notifications, and admin alerts. This is not a missing nonce or broken access control in isolation — it's a fundamental design flaw where enabling a marketing feature inadvertently exposes a privilege-escalation path. The fix, when available, should be a capability check (`current_user_can('manage_options')`) on the template modification endpoint — not merely a nonce, which would address CSRF but not the underlying authorization failure. If the patch contains only a nonce verification, the vulnerability will likely recur in other template endpoints. The EPSS score of 0.00353 almost certainly understates real-world risk. This feature is the plugin's premium selling point, and sites actively using AcyMailing for marketing automation are exactly the sites with multiple subscriber accounts. The precondition (admin enabled the email-routing toggle) describes a common configuration on production sites, not a rare edge case. The low EPSS reflects what automated scanners have tested, not what is actually exploitable. Check whether your AcyMailing installation has 'Send website emails' enabled. If it does, verify that the acy_notification_cms template cannot be modified by users without the manage_options capability. Until the architectural fix ships, consider disabling the email-routing feature if you have untrusted registered users.

Reviewed through automated stages and approved by a human before publication.