AcyMailing < 10.9.0 - Subscriber+ Privilege Escalation via 'acymailing_router'

Description

The plugin is vulnerable to Missing Authorization due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify privileged AcyMailing configuration, export subscriber secret keys, and chain these actions into administrator account takeover when a target administrator email address is known.