What is the CVSS score of CVE-2026-57739?

CVE-2026-57739 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of AcyMailing are affected by CVE-2026-57739?

The AcyMailing SMTP Newsletter plugin for WordPress contains a blind SQL injection vulnerability (CVSS 9.3) affecting all versions through 10.11.0, enabling remote attackers to extract database…

Is there a public PoC exploit available for CVE-2026-57739?

Yes, a public proof-of-concept exploit is available for CVE-2026-57739. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-57739?

Within 24 hours, immediately disable or uninstall the AcyMailing SMTP Newsletter plugin from all affected WordPress instances; if the plugin is business-critical, implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting the plugin's input endpoints. Within 7 days, conduct a database audit and review access logs for unauthorized queries or suspicious activity dating back to plugin deployment. Within 30 days, establish monitoring for vendor security updates, plan for alternative email marketing solutions, and maintain enhanced monitoring given the critical nature of the vulnerability.

AcyMailing CVE-2026-57739

EUVD-2026-43384 CRITICAL

SQL Injection (CWE-89)

2026-07-13 Patchstack

WordPress SQLi Wordpress Plugin Acymailing Smtp Newsletter Acymailing Newsletter Team

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-reachable low-complexity SQLi; PR:L chosen as most WordPress-plugin SQLi requires some authentication despite Patchstack's PR:N, blind read yields C:H/I:N with minor A:L.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:40 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

CRITICAL 9.3

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.

AnalysisAI

Blind SQL injection in the AcyMailing SMTP Newsletter plugin for WordPress (all versions up to and including 10.11.0) lets remote attackers inject arbitrary SQL through unsanitized input and extract database contents inference-by-inference. The CVSS 3.1 base score is 9.3, elevated by a changed scope and confidentiality impact against the underlying WordPress database. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the finding originates from Patchstack.

Technical ContextAI

AcyMailing is a widely used newsletter/email-marketing extension; this advisory concerns its SMTP Newsletter component for WordPress. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled data is concatenated into a SQL query without parameterization or adequate escaping. Because it is described as 'blind' SQL injection, the query results are not returned directly in the response; an attacker infers data via boolean or time-based side channels. The affected component, per CPE cpe:2.3:a:acymailing_newsletter_team:acymailing_smtp_newsletter:*, interacts with the shared WordPress MySQL/MariaDB database, so successful injection can reach data belonging to other plugins and core tables.

RemediationAI

Update the AcyMailing SMTP Newsletter plugin to the fixed release as directed by the vendor; a released patched version is not independently confirmed from the input data, and the affected range (<= 10.11.0) conflicts with the '10.10.2' string in the advisory slug, so verify the correct target version at the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/acymailing/vulnerability/wordpress-acymailing-smtp-newsletter-plugin-10-10-2-sql-injection-vulnerability) before deploying. Until a confirmed patch is applied, place a Web Application Firewall or Patchstack virtual patch in front of the site to block SQL-injection payloads to the plugin's endpoints, restrict access to AcyMailing admin/AJAX handlers to trusted users, and consider temporarily deactivating the SMTP Newsletter component if it is not business-critical - the trade-off being loss of newsletter sending until patched. Ensure database users used by WordPress hold least privilege so a read-only blind injection cannot be escalated.