CVE-2026-77807

The AcyMailing newsletter and marketing automation plugin for WordPress, in all versions up to and including 11.0.4, contains a directory traversal flaw (CWE-22) in the `user[name]` parameter. An unauthenticated attacker can submit crafted input containing directory traversal sequences, allowing the server to read the contents of arbitrary files on the host. This can expose sensitive files such as configuration files containing database credentials, potentially enabling further compromise of the site. Any WordPress site running AcyMailing 11.0.4 or earlier is affected, but only when the "Embed images" option is enabled in the AcyMailing configuration, which gates exploitation. There are currently no known public proofs of concept, no reports of in-the-wild exploitation, and the issue is not listed in the CISA KEV catalog.

What to do: Update AcyMailing to the first patched release after 11.0.4 (check the WordPress.org plugin page or vendor changelog for the current fixed version). If updating is not immediately possible, disable the "Embed images" option in the AcyMailing configuration as an interim mitigation. Administrators should also review web/server logs for unauthenticated requests containing traversal sequences in the `user[name]` parameter to determine whether sensitive files such as wp-config.php may have been read.