CVE-2026-95588 Overview
CVE-2026-95588 is an unauthenticated arbitrary file deletion vulnerability affecting the AcyMailing SMTP Newsletter plugin for WordPress through version 11.0.5. The flaw is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). An unauthenticated remote attacker can delete arbitrary files from the underlying filesystem over the network without user interaction. Deletion of files such as wp-config.php can force WordPress into setup mode, enabling site takeover scenarios. The vulnerability was published to NVD on October 1, 2026.
Critical Impact
Unauthenticated attackers can remotely delete arbitrary files on affected WordPress sites, which can lead to full site compromise when critical configuration files are targeted.
Affected Products
- AcyMailing SMTP Newsletter plugin for WordPress, versions <= 11.0.5
- WordPress sites running the vulnerable plugin
- Any environment where the plugin runs with webserver write permissions on application files
Discovery Timeline
- 2026-10-01 - CVE-2026-95588 published to NVD
- 2026-10-01 - Last updated in NVD database
Technical Details for CVE-2026-95588
Vulnerability Analysis
The vulnerability resides in file-handling logic within the AcyMailing SMTP Newsletter plugin. The plugin exposes functionality that accepts a file path parameter and performs a deletion operation without enforcing authentication or validating the resolved path against an allowed directory. An attacker supplies a traversal sequence that escapes the intended working directory. The resulting operation deletes files anywhere the PHP process has write access.
Because the attack requires no authentication and no user interaction, the vulnerable endpoint can be reached directly over HTTP or HTTPS. The impact is scoped as changed because files outside the plugin's trust boundary can be affected. Confidentiality and integrity impacts are not direct, but availability is high due to loss of required files.
Root Cause
The root cause is improper input validation on a file path parameter combined with missing authentication and authorization checks on the handler that performs the deletion. The code path does not canonicalize the user-supplied path, does not restrict operations to an allowlist of directories, and does not require a valid nonce or capability check. These three failures together satisfy the preconditions for [CWE-22] Path Traversal.
Attack Vector
Exploitation occurs across the network against the WordPress HTTP interface exposed by the vulnerable plugin. An attacker crafts a request that reaches the vulnerable file-deletion handler and supplies a path containing traversal sequences such as parent-directory references. The server resolves the path to a target outside the plugin directory and deletes it. Deleting wp-config.php is a known escalation path on WordPress because the site then enters installer mode, which can be hijacked to attach the site to an attacker-controlled database. For additional technical context, see the Patchstack advisory for AcyMailing SMTP Newsletter.
Detection Methods for CVE-2026-95588
Indicators of Compromise
- HTTP requests to AcyMailing plugin endpoints containing path traversal sequences such as ../ or URL-encoded equivalents (%2e%2e%2f).
- Unexpected deletion of WordPress core files, especially wp-config.php, .htaccess, or theme and plugin files.
- WordPress site unexpectedly entering the installation wizard, indicating that wp-config.php is missing.
- PHP error log entries referencing file-deletion operations originating from the AcyMailing plugin.
Detection Strategies
- Inspect web access logs for unauthenticated POST or GET requests to AcyMailing handler endpoints that include file path parameters.
- Alert on filesystem events where the webserver user deletes files outside the plugin's own directory tree.
- Correlate file-deletion events with inbound HTTP requests to identify the triggering source IP and payload.
Monitoring Recommendations
- Enable file integrity monitoring on the WordPress document root with priority on wp-config.php, .htaccess, and wp-admin/ contents.
- Forward webserver access logs and PHP error logs to a centralized log analytics platform for correlation and retention.
- Monitor for sudden transitions of production WordPress instances into installation state.
How to Mitigate CVE-2026-95588
Immediate Actions Required
- Update the AcyMailing SMTP Newsletter plugin to a version later than 11.0.5 as soon as the vendor releases a fixed build.
- If no patched version is available, deactivate and remove the plugin from all affected WordPress instances.
- Restrict access to WordPress administrative and AJAX endpoints at the web application firewall (WAF) with rules that block path traversal payloads.
- Audit the WordPress document root for missing or recently deleted files and restore from backup if tampering is observed.
Patch Information
Refer to the Patchstack advisory for the current patch status and fixed release information. Apply the vendor-supplied update across all WordPress sites that run AcyMailing SMTP Newsletter.
Workarounds
- Block requests to the vulnerable AcyMailing endpoints at the WAF or reverse proxy until the plugin is updated.
- Enforce filesystem permissions so the webserver user cannot delete wp-config.php or other core files outside expected upload directories.
- Place wp-config.php one directory above the WordPress web root where supported by the hosting environment.
- Maintain offline backups of the WordPress document root and database to enable rapid recovery if files are deleted.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
