CVE-2026-95588: WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Arbitrary File Deletion vulnerability
Published Oct 1, 2026
·Updated
Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.
Affected Software
1 affected component
AcyMailing SMTP Newsletter<=11.0.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress AcyMailing SMTP Newsletter pluginto a version that resolves this vulnerability.Fixed in 11.1.0
Event History
Oct 1, 2026
CVE Published
via MITRE·02:33 PM
Data Sourced
via MITRE·02:33 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
No authentication is required. The issue is remotely exploitable with low attack complexity and does not require user interaction.
2
What is the potential impact?
An attacker may be able to delete arbitrary files through path traversal. The supplied severity vector indicates high availability impact, with no stated confidentiality or integrity impact.
3
Which plugin versions are affected?
AcyMailing SMTP Newsletter versions 11.0.5 and earlier are identified as affected.