WordPress AcyMailing Plugin Missing Authorization Flaw

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 10.8.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify privileged AcyMailing configuration, export subscriber secret keys, and chain these actions into administrator account takeover when a target administrator email address is known.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-5200 represents a critical authorization bypass in the AcyMailing WordPress plugin affecting versions up to 10.8.2. The vulnerability allows authenticated subscribers to escalate privileges by modifying sensitive plugin configurations and exporting subscriber secret keys without proper permission checks. This impacts any WordPress site running the plugin with active user accounts, enabling lateral movement and data exfiltration attacks that can compromise subscriber databases and lead to administrative account takeover.

Casky's 261 matching skills leverage Claude's reasoning capabilities to detect the attack patterns mapped to TA0004 (Privilege Escalation) and TA0006 (Credential Access) by identifying suspicious authorization bypass indicators. Practitioners would see findings highlighting: unauthorized configuration modification attempts by low-privileged accounts, unusual API calls to export sensitive key material, and privilege escalation sequences where subscriber-level users access admin-only functions. The AI-driven analysis connects these discrete events into coherent attack chains, surfacing how attackers chain missing authorization checks to export credentials and pivot toward full administrative compromise—enabling faster detection and response before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-5200.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-5200

Casky has 261 skills that investigate the attack patterns behind CVE-2026-5200. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn