CVE-2026-57739: critical vulnerability in AcyMailing SMTP Newsletter
WordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerability
Published
50Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Actcvss 9.3epss 0.4%
from disclosure to weapon
Published on NVDJul 13
VulnCheck+40d
exploitation probability
0.4%top 68% of all CVEs
observed exploitation
yesVulnCheck
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Affected products
AcyMailing Newsletter Team · AcyMailing SMTP NewsletterRelated CVEs — AcyMailing SMTP Newsletter
In the same product, most dangerous first.
CVE-2026-94389CRITICALWordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerabilityEPSS 0.5%CVE-2026-95588HIGHWordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerabilityEPSS 0.3%CVE-2026-28181MEDIUMWordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57740HIGHWordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-24617HIGHWordPress AcyMailing Plugin < 9.11.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57741HIGHWordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%