CVE-2026-66689 MEDIUM

CVE-2026-66689: WordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerability

Vendor Acymailing Newsletter Team

Product Anti Spam and list cleaner – AcyChecker

Weakness CWE-862 · Missing authorization

Published August 13, 2026

Last update August 13, 2026

View on NVD All CVEs

CVSS base score

6.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

AcyChecker fails to properly check user permissions before allowing access to sensitive functions. An attacker with a low-privilege account can read, modify, or delete data without authorization. The vulnerability affects AcyChecker up to version 2.0.0. Update to a version newer than 2.0.0 when available.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete data without proper authorization using a low-privilege account.

Potential impact on your site

04Site Impact

Unauthorized users can access and alter sensitive newsletter or subscriber data stored by AcyChecker.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account on the site; no user interaction required.

Key dates

06Disclosure timeline

August 13, 2026 CVE published

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-66689 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html AskarLabs — CWE-862 write-up Missing Authorization

Related vulnerabilities

Identifiers

CVE CVE-2026-66689

CWE CWE-862

CVSS 6.3 / MEDIUM

Affected versions