AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Arbitrary File Deletion via File Custom Field
- ID
- WPSEC-2026-0318
- Plugin
- AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress (acymailing)
- Affected
- from 10.8.0 before 11.1.0
- Remediation
- Update to 11.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
- Weakness
- CWE-22
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The AcyMailing plugin for WordPress is vulnerable to arbitrary file deletion via 'file' type custom fields in versions 10.8.0 up to, and including, 11.0.5. This is due to insufficient file path validation in the FieldClass::store() function: a file field's value could be set to any posted string instead of only through a real upload, and when the field was later emptied the stored value was appended to the userfiles path and passed to the file deletion routine without basename() or a directory check. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, such as wp-config.php, by subscribing through a front-end form with a traversal path (e.g. '../../../wp-config.php') as the file field's value and then resubmitting their own subscriber record with that field empty, using the subscriber key links AcyMailing emails to the address they registered (or a logged-in account). Deleting wp-config.php can lead to full site takeover. Exploitation requires a 'file' type custom field to exist (custom fields are a premium feature); the field does not need to be shown on the form.
References
- https://wpsec.com/vuln/WPSEC-2026-0318/
- https://plugins.svn.wordpress.org/acymailing/tags/11.1.0/
- https://wordpress.org/plugins/acymailing/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS