External risk intelligence

AcyMailing SMTP Newsletter Blind SQL Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-57739

This vulnerability affects a WordPress plugin designed for newsletter management. Such plugins are typically installed on web servers to process user interactions and are commonly exposed to the public internet to facilitate newsletter signups, subscription management, and email processing.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the AcyMailing SMTP Newsletter, specifically a SQL Injection flaw that could allow unauthorized access to data. This issue affects versions up to and including 10.11.0, and its network-accessible nature and potential for broad impact warrant attention.

Attackers can steal sensitive information.
Prevents unauthorized data access by external parties.
Assess relevance and potential exposure promptly.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted SQL commands through the AcyMailing SMTP Newsletter component. This could allow them to access or manipulate sensitive database information.

No user interaction needed for entry.
Triggered via SQL injection in the component.
Allows sensitive data access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious SQL commands into the AcyMailing SMTP Newsletter. When supported by the advisory's conditions, this could lead to the exposure of sensitive system data or unauthorized modification of service behavior, impacting the integrity and confidentiality of the application.

System data exposure.
SQL injection via network.
Compromised service integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical SQL injection vulnerability in AcyMailing SMTP Newsletter requires immediate attention from teams managing web applications and their underlying infrastructure. The first practical step is to identify all instances of the affected AcyMailing SMTP Newsletter, assess their exposure and business criticality, and then engage the accountable application or platform owners to plan and execute remediation. Coordination with the vendor may also be necessary.

Application and platform teams own remediation.
Verify AcyMailing instances and exposure.
Plan vendor-coordinated fixes and deployment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the AcyMailing SMTP Newsletter plugin?

It is a WordPress plugin used to manage email newsletters, handle subscription lists, and facilitate email delivery. Because it integrates directly with a website's database to store user contact information and track mailing performance, it acts as a bridge between public web interactions and backend data storage.

How does CVE-2026-57739 function as a Blind SQL Injection?

This vulnerability belongs to the CWE-89 weakness class. It occurs when the plugin fails to properly sanitize user-supplied input before using it in a database query. In a 'blind' injection, an attacker cannot see the direct database output, but they can infer information by observing how the website responds to true or false questions sent to the database.

Do I need to interact with the site for this to be triggered?

No. The vulnerability is triggered by an attacker sending specially crafted SQL commands directly to the plugin over a network connection. This does not require the attacker to have an account, nor does it require any action from a legitimate user or administrator to succeed.

Is my site relevant to this risk?

Halo Surface Signal notes that since this plugin is often exposed to the public internet for newsletter signups, it is highly reachable by attackers. If your instance is internet-facing, it is at higher risk than an internal-only installation because the entry point for the malicious commands is accessible to anyone on the web.

What is the first step to address this CVE?

Start by identifying all WordPress sites in your environment running AcyMailing SMTP Newsletter versions 10.11.0 or older. Once you have a list of these instances, evaluate their specific exposure and reach out to the application owners to coordinate the application of security patches or vendor-provided updates.

References

patchstack.com/database/Wordpress/Plugin/acymailing/vulnerability/wo…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.