EUVD-2026-43384Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Network-reachable low-complexity SQLi; PR:L chosen as most WordPress-plugin SQLi requires some authentication despite Patchstack's PR:N, blind read yields C:H/I:N with minor A:L.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.
AnalysisAI
Blind SQL injection in the AcyMailing SMTP Newsletter plugin for WordPress (all versions up to and including 10.11.0) lets remote attackers inject arbitrary SQL through unsanitized input and extract database contents inference-by-inference. The CVSS 3.1 base score is 9.3, elevated by a changed scope and confidentiality impact against the underlying WordPress database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability is a blind SQL injection reachable over the network against the AcyMailing SMTP Newsletter plugin (<= 10.11.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends crafted input to a vulnerable AcyMailing parameter and observes conditional differences in responses or timing to extract data character-by-character. Over repeated automated requests, they enumerate the WordPress database - including wp_users password hashes and secret keys - enabling account compromise. … |
| Remediation | Update the AcyMailing SMTP Newsletter plugin to the fixed release as directed by the vendor; a released patched version is not independently confirmed from the input data, and the affected range (<= 10.11.0) conflicts with the '10.10.2' string in the advisory slug, so verify the correct target version at the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/acymailing/vulnerability/wordpress-acymailing-smtp-newsletter-plugin-10-10-2-sql-injection-vulnerability) before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately disable or uninstall the AcyMailing SMTP Newsletter plugin from all affected WordPress instances; if the plugin is business-critical, implement Web Application Firewall (WAF) rules to block SQL injection patterns targeting the plugin's input endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Acymailing Smtp Newsletter
View allStored cross-site scripting in the AcyMailing SMTP Newsletter plugin for WordPress allows attackers to persist malicious
Broken access control in the AcyMailing SMTP Newsletter plugin for WordPress (versions up to and including 10.11.1) lets
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today