CVE-2026-94389: WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability

Q: What does an attacker need to attempt exploitation?

The vulnerability is remotely reachable over the network and does not require authentication or user interaction. Exploitation is rated as high complexity.

Q: What could a successful exploit allow an attacker to affect?

The reported impact is high for confidentiality, integrity, and availability. The vulnerability also has changed scope, indicating the impact can extend beyond the initially affected security authority.

Published Sep 30, 2026

Updated

Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.

Affected Software

1 affected component

AcyMailing AcyMailing SMTP Newsletter<=11.0.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress AcyMailing SMTP Newsletter plugin to a version that resolves this vulnerability.
Fixed in 11.1.0

Event History

Sep 30, 2026

CVE Published

via MITRE·12:27 PM

Data Sourced

via MITRE·12:27 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to attempt exploitation?

The vulnerability is remotely reachable over the network and does not require authentication or user interaction. Exploitation is rated as high complexity.

What could a successful exploit allow an attacker to affect?