AcyMailing EUVD-2026-90855

Exploitation requires only that the AcyMailing SMTP Newsletter plugin version 11.0.5 or earlier be installed and reachable on a WordPress site; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no special configuration needed - remote unauthenticated exploitation against default installations. The practical limiting factors are that the target must run the affected plugin version and the attacker must reach the vulnerable HTTP endpoint (not firewalled/WAF-blocked); the file actually deleted is constrained by the web server process's filesystem permissions.

This is a genuine high-priority issue by its technical profile, not merely an inflated CVSS number. The vendor (Patchstack) vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H (8.6) describes a fully remote, unauthenticated, low-complexity path-traversal file deletion requiring no user interaction - the worst combination of accessibility metrics. For arbitrary file deletion in a WordPress plugin, the realistic consequence exceeds pure availability: deleting wp-config.php can force WordPress into its setup/reinstall state, enabling site takeover, so the true impact arguably includes integrity, not just the A:H the vendor assigned. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation likelihood must be inferred from the trivial attack requirements rather than observed telemetry. The main caveat is single-sourcing: all data traces to one Patchstack advisory with no NVD CVSS, no independent confirmation, and no fixed-version statement, so affected-version and impact details should be validated against the vendor before treating as fully confirmed.

A remote attacker sends a crafted HTTP request to the AcyMailing SMTP Newsletter plugin endpoint containing directory-traversal sequences (e.g. ../../) in a file-path parameter, requiring no authentication and no user interaction. The plugin resolves the attacker-controlled path and deletes the targeted file; by removing wp-config.php or other critical files the attacker can disrupt the site or push WordPress into a re-installation state leading to takeover. No public POC was identified in the provided data, but the AC:L/PR:N/UI:N profile makes reliable exploitation straightforward once the vulnerable parameter is known.