CVE-2026-57739: AcyMailing SMTP Newsletter SQLi Flaw

CVE-2026-57739 Overview

CVE-2026-57739 is a blind SQL injection vulnerability in the AcyMailing SMTP Newsletter plugin for WordPress. The flaw affects all versions from an unspecified initial release through 10.11.0. The vulnerability results from improper neutralization of special elements used in SQL commands [CWE-89], allowing unauthenticated attackers to inject arbitrary SQL statements over the network.

Attackers can exploit this issue without authentication or user interaction, making WordPress sites running the affected plugin exposed to remote database compromise. The vulnerability was cataloged by Patchstack in the WordPress plugin vulnerability database.

Critical Impact
Unauthenticated attackers can execute arbitrary SQL queries against the WordPress database, enabling extraction of subscriber data, credentials, and administrative content.

Affected Products

AcyMailing SMTP Newsletter plugin for WordPress
Versions from initial release through 10.11.0 (inclusive)
WordPress sites using AcyMailing for email marketing and newsletter delivery

Discovery Timeline

2026-07-13 - CVE-2026-57739 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57739

Vulnerability Analysis

CVE-2026-57739 is a blind SQL injection flaw in the AcyMailing SMTP Newsletter plugin. The plugin fails to properly sanitize user-supplied input before incorporating it into SQL queries. Because the injection is blind, attackers infer query results through inference techniques such as boolean-based or time-based responses rather than direct output.

The attack vector is network-based and requires no privileges or user interaction. The scope is changed, meaning a successful exploit can affect resources beyond the vulnerable component's security scope. This is consistent with SQL injection reaching the underlying WordPress database shared by the entire site.

The EPSS score of 0.291% (21st percentile) indicates the exploitation likelihood is modest at present, though WordPress plugin vulnerabilities frequently attract opportunistic scanning after disclosure.

Root Cause

The root cause is a failure to parameterize or properly escape user input passed into SQL statements. Instead of using prepared statements or WordPress's $wpdb->prepare() API with placeholders, the plugin concatenates untrusted values into query strings. This allows attackers to alter query semantics by injecting SQL syntax.

Attack Vector

An attacker sends a crafted HTTP request to a vulnerable AcyMailing endpoint on a WordPress site. The malicious payload contains SQL fragments that modify the intended query. Because the injection is blind, the attacker uses conditional payloads and observes application behavior or response timing to reconstruct data.

A typical exploitation chain uses conditional statements such as AND SLEEP(5) or AND (SELECT 1 FROM ...) payloads to enumerate database contents byte-by-byte. Refer to the Patchstack advisory for technical details on the vulnerable parameter.

Detection Methods for CVE-2026-57739

Indicators of Compromise

HTTP requests to AcyMailing plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or encoded variants
Unusually long HTTP response times from AcyMailing endpoints indicating time-based blind injection attempts
Repeated requests from a single source enumerating parameter values, characteristic of automated blind SQL injection tools such as sqlmap
WordPress database error entries or unexpected query patterns in wp-content/debug.log

Detection Strategies

Deploy a web application firewall (WAF) with SQL injection signature rules covering the AcyMailing plugin request paths
Enable MySQL general query logging temporarily to identify anomalous query structures originating from the plugin
Monitor for requests where AcyMailing parameters contain characters such as ', ", --, ;, or URL-encoded equivalents
Correlate HTTP access logs with database slow query logs to detect time-based blind injection patterns

Monitoring Recommendations

Alert on outbound data volume spikes from the web server, which may indicate data exfiltration through iterative blind extraction
Track authentication failures and privileged actions in WordPress immediately following suspicious plugin traffic
Monitor for creation of new administrative WordPress users or modifications to the wp_users and wp_usermeta tables
Baseline normal AcyMailing request patterns and alert on deviations in request frequency or parameter length

How to Mitigate CVE-2026-57739

Immediate Actions Required

Update the AcyMailing SMTP Newsletter plugin to a version later than 10.11.0 once the vendor publishes a fix
If no patched version is available, deactivate and remove the plugin from affected WordPress installations
Rotate WordPress administrator credentials and any API keys stored in the database
Audit the WordPress database for unauthorized users, injected content, or altered plugin configuration

Patch Information

At the time of publication, the CVE record indicates all versions through 10.11.0 are affected. Consult the Patchstack advisory and the AcyMailing vendor page for the fixed release version.

Workarounds

Restrict access to WordPress admin and AcyMailing endpoints via IP allowlisting at the web server or reverse proxy
Deploy WAF rules that block SQL metacharacters in requests targeting AcyMailing plugin paths
Reduce database user privileges assigned to WordPress so that the account cannot execute INFORMATION_SCHEMA queries or write to unrelated tables
Enable database query logging and review logs for injection attempts during the mitigation window

bash

# Example ModSecurity rule to block common SQL injection payloads to AcyMailing endpoints
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1002026,\
    msg:'Potential SQL injection targeting AcyMailing (CVE-2026-57739)'"
    SecRule ARGS "@rx (?i)(union(\s|\+)+select|sleep\s*\(|benchmark\s*\(|--\s|/\*)" \
        "t:none,t:urlDecodeUni"