AcyMailing versions prior to 10.11.1 contain an unauthenticated SQL injection vulnerability in the subscription[] parameter. An attacker can inject arbitrary SQL through this parameter, potentially reading, modifying, or deleting data stored in the site’s database. This flaw gives the attacker complete control over the database contents for that WordPress site, leading to data disclosure, credential theft, and service disruption. The weakness is a classic SQL injection, classified as CWE‑89.

The vulnerable product is the WordPress plugin AcyMailing, versions earlier than 10.11.1. Any WordPress installation that has an affected AcyMailing plugin deployed and exposed to the internet is at risk.

The vulnerability has a CVSS score of 8.2, indicating high severity. The EPSS score is reported as less than 1 %, indicating a very low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the attack vector is unauthenticated, allowing any web‑connected user to send a crafted request with a malicious subscription[] payload, provided the target site is reachable and the plugin is enabled. Due to the potential for significant damage and the lack of authentication controls, administrators should treat this flaw as high severity subject to the available fix.