Is CVE-2026-5200 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5200 being exploited in the wild.

How severe is CVE-2026-5200?

High severity, with a CVSS score of 8.8, published 20 May 2026.

Which products and versions are affected?

Acyba AcyMailing up to, and including, 10.8.2.

Is there a fix for CVE-2026-5200?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5200 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5200?

Check whether you run Acyba AcyMailing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5200: Acyba AcyMailing missing authorization in WordPress plugin

CVE-2026-5200 · Severity: high · CVSS 8.8 · Published 2026-05-20

AcyMailing, a popular WordPress plugin used for managing newsletters and marketing automation, contains a security flaw that allows low-level users to perform administrative actions. An attacker with a basic subscriber account could modify the plugin's settings or export sensitive security keys. This can ultimately lead to a full takeover of the website's administrator account if the attacker knows the admin's email address.

Technologies: Acyba AcyMailing. Vendors: Acyba.

Quick answers

Is CVE-2026-5200 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5200 being exploited in the wild.
How severe is CVE-2026-5200?: High severity, with a CVSS score of 8.8, published 20 May 2026.
Which products and versions are affected?: Acyba AcyMailing up to, and including, 10.8.2.
Is there a fix for CVE-2026-5200?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5200 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5200?: Check whether you run Acyba AcyMailing at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The AcyMailing plugin for WordPress (up to version 10.8.2) suffers from a missing authorization vulnerability (CWE-862) due to insufficient permission checks on certain plugin functions. Authenticated attackers with subscriber-level privileges or higher can exploit this to modify privileged configuration settings and export subscriber secret keys. By chaining these capabilities, an attacker who knows a target administrator's email address can achieve a full account takeover. The vulnerability is addressed in versions following 10.8.2.

Affected products

Acyba AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress up to, and including, 10.8.2

Timeline

2026-05-20: disclosed: CVE published by Wordfence and NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.