CVE-2026-77807 acyba CVE debrief

Who should care

Defenders responsible for WordPress installations with the AcyMailing plugin should assess exposure and prioritize updates and monitoring due to the HIGH-severity vulnerability allowing unauthenticated file access. This includes reviewing server configurations, monitoring for suspicious activity, and ensuring the 'Embed images' option is not enabled if not necessary.

Why it matters

CVE-2026-77807 is a HIGH-severity vulnerability in the AcyMailing plugin for WordPress, allowing unauthenticated attackers to read arbitrary files. Defenders should prioritize verifying and updating plugin versions, reviewing server configurations, and monitoring for suspicious activity.

• Verify and update AcyMailing plugin versions to prevent exploitation.
• Review server configurations to prevent unauthorized file access.
• Monitor for suspicious file access attempts to detect potential exploitation.

Technical summary

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires 'Embed images' option in AcyMailing configuration being enabled.

Defensive priority

Defenders should prioritize verifying and updating AcyMailing plugin versions, reviewing server configurations, and monitoring for suspicious file access attempts.

Recommended defensive actions

• Verify and update AcyMailing plugin versions to ensure the latest security patches are applied.
• Review server configurations to prevent exploitation.
• Monitor for suspicious file access attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.5 and HIGH severity. The vulnerability is caused by a Directory Traversal issue in the AcyMailing plugin for WordPress, which allows unauthenticated attackers to read arbitrary files on the server.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.