CVE-2026-57739

WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability

View on CVE.org
Published Jul 13, 2026 CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.

Analysis

AI-generated

Technical impact

The flaw is a classic SQL injection caused by improper neutralization of special elements used in SQL commands. It allows an attacker to inject blind SQL payloads into the AcyMailing SMTP Newsletter plugin’s input handling, potentially retrieving, modifying, or deleting data stored in the underlying WordPress database.

Affected Systems

All WordPress installations that have the AcyMailing SMTP Newsletter plugin from the AcyMailing Newsletter Team and are running version 10.11.0 or earlier.

Risk and Exploitability

With a CVSS score of 9.3 the vulnerability is rated critical, but the EPSS score of less than 1 % indicates that real‑world exploitation is rare. The injection is blind, requiring repeated queries or timing attacks to infer results, and the attack vector is through the web layer—any external user that can reach the plugin’s HTTP endpoints can craft the payload.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the AcyMailing SMTP Newsletter plugin to a version newer than 10.11.0.
  • If an upgrade is not available, deactivate or uninstall the plugin to remove the vulnerable code path.
  • Deploy Web Application Firewall rules that detect and block typical SQL injection patterns against the plugin’s endpoints.
  • Ensure that the database user configured for WordPress has only the minimum permissions required, limiting the potential impact of a successful injection.

Generated by OpenCVE AI on August 1, 2026 at 10:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Acymailing Newsletter Team
Acymailing Newsletter Team acymailing Smtp Newsletter
Wordpress
Wordpress wordpress
Vendors & Products Acymailing Newsletter Team
Acymailing Newsletter Team acymailing Smtp Newsletter
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.
Title WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Jul 13, 2026, 2:23 PM
Reserved
Jun 25, 2026, 8:04 AM

View source JSON

Updated
Jul 13, 2026, 2:23 PM

JSON

Status
Deferred
Published
Jul 13, 2026, 10:16 AM
Modified
Oct 24, 2026, 10:10 PM

View source JSON

No data.

Updated
Aug 1, 2026, 10:45 AM

JSON