CVE-2024-7384 is an arbitrary file upload flaw in the AcyMailing newsletter plugin for WordPress. It is rated High (CVSS 7.5) and affects all versions up to and including 9.7.2. An authenticated user with Subscriber access or above can upload files, which may allow code execution.
What's affected
Per the NVD record, the AcyMailing plugin for WordPress is vulnerable "in all versions up to, and including, 9.7.2". The cause is missing file type validation in the acym_extractArchive function. The record says authenticated attackers with Subscriber level access and above can upload arbitrary files to the server, which "may make remote code execution possible".
The record points to changes in the plugin's trunk (changeset 3137644), the WordPress.org developer page and the vendor changelog, and to a Wordfence entry. I could not load the Wordfence entry or the Trac changeset, so I cannot name the first fixed version from a page I read. The vendor changelog I could read shows a 9.8.0 release dated 19 August 2024 that mentions improved security checks on file uploads, but it does not tie that line to this CVE. Treat 9.8.0 as a likely candidate, and confirm the exact fixed version on the plugin's WordPress.org page or in the vendor changelog before you close the ticket. Anything above 9.7.2 is outside the stated range.
Note that AcyMailing also ships for Joomla, and the changelog covers both. This record is about the WordPress plugin only.
How to check if you're exposed
Use WP-CLI on each site.
wp plugin list --name=acymailing --fields=name,status,version
If the version is 9.7.2 or lower, the site is in range. You can also open Plugins in the WordPress admin and read the version under the plugin name. For many sites, run the same command through your management tooling and collect the output.
Then look at who can log in. The flaw needs only Subscriber access, so a site that allows open registration gives that access to anyone. Check Users, then Settings, then General, to see whether membership is open and which default role is assigned.
What to do now
- Update AcyMailing to the latest release from the WordPress.org plugin page, and confirm it is above 9.7.2.
- If you cannot update today, deactivate the plugin on sites that do not need it right now.
- Turn off open registration where it is not needed, and review recent new accounts on any site that had it on.
- Look for unexpected files under wp-content, especially archives and script files you did not add.
- Keep a list of plugins and versions across all sites so the next advisory is a quick lookup. A dependency inventory is the same idea for application libraries.
Why it matters
The weakness is CWE-434, unrestricted upload of a file of a dangerous type. A function that unpacks archives has to decide which files may land on disk. If it skips that check, a low privileged user can place files the server may later run.
The score of 7.5 reflects a high attack complexity in the CVSS vector, with low privileges required and no user interaction. Even so, the impact is rated High on confidentiality, integrity and availability, because code execution on a web server is a serious outcome. The record does not carry a KEV flag, and I found no report of exploitation in what I read.
Quick check
Do attackers need an administrator account?
No. The record says Subscriber level access and above is enough, which is the lowest normal WordPress role.
Which version fixes CVE-2024-7384?
The record says versions up to 9.7.2 are affected. Check the plugin's WordPress.org page or vendor changelog for the exact fixed release, as I could not confirm it from the pages I could read.
Sources
Last reviewed: 19 October 2026.
