AcyMailing CVE-2026-14920

No authentication is required - the vulnerable parameter is accessible to unauthenticated HTTP requests, consistent with the CVSS vector PR:N and AV:N. Attack complexity is low (AC:L) and no user interaction is needed (UI:N), meaning exploitation can be attempted against any reachable WordPress installation running AcyMailing below version 10.11.1 without prerequisite steps. Exploitation is limited to environments where: (1) the AcyMailing plugin is installed and active on a WordPress site, and (2) the site is reachable over the network. No special server-side configuration or feature flag is required beyond plugin activation. Scope is unchanged (S:U), meaning the attack is confined to the WordPress application's database context and does not pivot to other systems directly.

The CVSS 8.2 score is driven by four favorable-to-attacker metrics: network attack vector, low complexity, no privileges required, and no user interaction - a classic unauthenticated SQLi profile. High confidentiality impact (C:H) reflects full database read access; limited integrity impact (I:L) allows partial data manipulation. However, the EPSS score of 0.19% at the 8th percentile is conspicuously low relative to that CVSS score and the existence of a public PoC, suggesting that real-world exploitation has not yet become widespread. The absence from CISA KEV corroborates this. The practical risk is elevated for sites hosting sensitive subscriber data or e-commerce information in the same database. The gap between CVSS and EPSS may reflect the relatively niche deployment footprint of the plugin compared to core WordPress components or that automated exploitation tooling has not yet widely adopted the PoC. Organizations running AcyMailing should treat this as a high priority despite the low EPSS, given the zero-barrier exploitation path and publicly available exploit code.

An unauthenticated remote attacker sends a crafted HTTP request to a WordPress site running AcyMailing, embedding SQL metacharacters into a vulnerable parameter processed by the plugin's database layer. The injected payload manipulates the SQL query to extract sensitive records - such as hashed WordPress user passwords, subscriber email addresses, or stored API keys - from the site's database and returns them in the server response. A public PoC is available via WPScan, lowering the technical barrier for exploitation significantly.