AcyMailing SMTP Newsletter CVE-2026-94389

Exploitation targets WordPress installations with the AcyMailing SMTP Newsletter plugin at version 11.0.5 or earlier installed and active. Per CVSS the attack is remote and unauthenticated with no user interaction (AV:N/PR:N/UI:N), so no account or victim click is required; however, AC:H signals a real limiting factor - reliable exploitation likely depends on a specific precondition, application state, or configuration/timing that the attacker must arrange or wait for, rather than a straightforward single request. The primary limits on real-world risk are therefore: the plugin must be present and within the vulnerable version range, and the attacker must overcome the high attack-complexity condition; there is no public PoC referenced to lower that barrier at this time.

This is a genuinely high-priority issue on paper: CVSS 3.1 base 9.0 driven by AV:N/PR:N/UI:N (remote, unauthenticated, no user interaction), S:C (scope change), and full C:H/I:H/A:H impact - consistent with unauthenticated RCE in a WordPress plugin (CWE-94 code injection). The single moderating signal in the vector is AC:H, indicating the exploit is not trivially fire-and-forget and likely requires meeting specific timing, state, or configuration conditions. However, real-world exploitation signals are thin: there is no EPSS score provided, no CISA KEV listing, and no public proof-of-concept referenced - the only source is a single Patchstack advisory, so this reflects 'no public exploit identified at time of analysis' rather than confirmed active exploitation. The AC:H versus otherwise-critical profile is worth verifying: unauthenticated RCE in a mail-sending plugin is highly attractive to opportunistic attackers, and if a working exploit becomes public the AC:H barrier may fall quickly. Net: treat as a real priority for anyone running the affected plugin and patch promptly, but current evidence points to potential rather than observed mass exploitation. Note the description asserts RCE while the vector's S:C/C:H/I:H/A:H is directionally consistent, but the exact code-injection sink is not disclosed in the provided data - verify specifics with the Patchstack advisory.

A remote attacker without any account sends a specially crafted request to a WordPress site running AcyMailing SMTP Newsletter <= 11.0.5, triggering the code-injection flaw (CWE-94) to execute arbitrary PHP on the server. Because the attack is unauthenticated (PR:N) with no user interaction (UI:N) but rated AC:H, the attacker likely must satisfy a specific precondition or timing/state requirement to reliably land execution. No public PoC is referenced, so exploitation would currently require independent development.