CVE-2026-57740: high-severity vulnerability in AcyMailing SMTP Newsletter
WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability
Published
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.3%
exploitation probability
0.3%top 76% of all CVEs
observed exploitation
nono source reports it
Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Affected products
AcyMailing Newsletter Team · AcyMailing SMTP NewsletterRelated CVEs — AcyMailing SMTP Newsletter
In the same product, most dangerous first.
CVE-2026-94389CRITICALWordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerabilityEPSS 0.5%CVE-2026-57739CRITICALWordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - SQL Injection vulnerabilityEPSS 0.4%CVE-2026-95588HIGHWordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerabilityEPSS 0.3%CVE-2026-28181MEDIUMWordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-24617HIGHWordPress AcyMailing Plugin < 9.11.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57741HIGHWordPress AcyMailing SMTP Newsletter plugin <= 10.11.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%