What is the CVSS score of CVE-2026-14920?

CVE-2026-14920 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of AcyMailing are affected by CVE-2026-14920?

AcyMailing's unauthenticated SQL injection vulnerability creates an open database access point for any attacker without requiring credentials or user interaction.. A patch is available.

Is there a public PoC exploit available for CVE-2026-14920?

Yes, a public proof-of-concept exploit is available for CVE-2026-14920. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-14920?

Within 24 hours: Identify all WordPress installations running AcyMailing and document current versions, then immediately upgrade to version 10.11.1 or later on all affected systems. Within 7 days: Verify successful patch deployment across all infrastructure and audit database access logs for unauthorized SQL queries that may have occurred during the exposure window. Within 30 days: Conduct forensic analysis of database access patterns to confirm whether customer data was exfiltrated, deploy SQL injection detection rules in your Web Application Firewall if not already configured, and establish automated monitoring for WordPress plugin security advisories.

AcyMailing CVE-2026-14920

EUVD-2026-51930 HIGH

SQL Injection (CWE-89)

2026-08-02 WPScan

GHSA-g7h4-q4cj-pqfw

SQLi Acymailing Unknown

8.2

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Unauthenticated network-accessible SQLi yields full DB read (C:H) and limited write (I:L); no availability impact identified.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 20:23 vuln.today

CVSS changed

Aug 04, 2026 - 20:22 NVD

8.2 (HIGH)

Patch available

Aug 02, 2026 - 07:00 EUVD

CVE Published

Aug 02, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 02, 2026 - 06:00 cve.org

HIGH 8.2

DescriptionCVE.org

Summary

AnalysisAI

Unauthenticated SQL injection in AcyMailing WordPress plugin (versions before 10.11.1) allows remote attackers to read sensitive data from the underlying database and perform limited data modification without any credentials. Reported by WPScan and assigned CVSS 8.2, the flaw is network-exploitable with no user interaction required. A publicly available proof-of-concept exists; however, EPSS sits at 0.19% (8th percentile), indicating minimal observed exploitation activity at time of analysis despite the public PoC, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

AcyMailing is a WordPress email marketing and newsletter plugin. CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) identifies the root cause: user-supplied input reaches a database query without adequate sanitization or parameterization, enabling an attacker to alter the query's logic. The CPE string cpe:2.3:a:unknown:acymailing:*:*:*:*:*:*:*:* covers all versions up to (but not including) 10.11.1 per EUVD-2026-51930. Because AcyMailing runs within the WordPress PHP environment and shares the site's MySQL/MariaDB connection, a successful injection can expose the entire wp_ database schema - including user credentials, subscription lists, and plugin configuration data - to the attacker.

RemediationAI

Upgrade AcyMailing to version 10.11.1 or later; this is the vendor-released patch addressing CVE-2026-14920 as confirmed by the EUVD advisory and the WPScan report at https://wpscan.com/vulnerability/66e61aa1-4e2e-4fe7-b92b-a0d11e4b596f/. If immediate upgrading is not feasible, deactivating the AcyMailing plugin entirely eliminates the attack surface at the cost of losing all email marketing functionality. As a partial compensating control, deploying a Web Application Firewall (WAF) rule to detect and block SQL injection patterns in HTTP parameters processed by AcyMailing endpoints can reduce exploitation likelihood, though WAF rules cannot be considered a reliable substitute for patching and may produce false positives on legitimate plugin traffic. Additionally, applying the principle of least privilege to the WordPress database user account - restricting it to only the schemas and operations required - limits the blast radius of a successful injection.