AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.5 - Unauthenticated Arbitrary File Upload via Email Attachment in POP3 Mailbox Processing
- ID
- WPSEC-2026-0319
- Plugin
- AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress (acymailing)
- Affected
- all versions before 11.1.0
- Remediation
- Update to 11.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-434
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The AcyMailing plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 11.0.5. This is due to missing file type validation in the BounceHelper::decodeMessagePear() function, which bounce handling and mailbox actions use when a mailbox is read with the 'POP3 (without imap extension)' method: every non-text MIME part was treated as an image and written to the public AcyMailing upload folder (wp-content/uploads/acymailing/upload/) under the extension given in the message, without checking the allowed or forbidden file types. This makes it possible for unauthenticated attackers who can send an email to a mailbox the site processes to place arbitrary files, such as PHP scripts, on the server, which may make remote code execution possible. Exploitation requires bounce handling or mailbox actions (premium features) to be configured with the 'POP3 (without imap extension)' connection method.
References
- https://wpsec.com/vuln/WPSEC-2026-0319/
- https://plugins.svn.wordpress.org/acymailing/tags/11.1.0/
- https://wordpress.org/plugins/acymailing/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS