AcyMailing SMTP Newsletter: Unauthenticated remote code execution

Summary

AcyMailing SMTP Newsletter, a WordPress newsletter plugin, contains a remote code execution vulnerability (CWE-94, code injection) in versions up to and including 11.0.5. An unauthenticated attacker can run arbitrary commands on the web server over the network. The CVSS vector rates attack complexity as high, but Patchstack classifies the issue as high priority and expects exploitation.

Affected

• AcyMailing SMTP Newsletter (WordPress plugin) up to and including 11.0.5
• Joomla installations: not confirmed for this CVE

Fixed in

• Update to version 11.1.0 or later (Patchstack and the CVE record name 11.1.0 as the patched version).

Workaround

• Patchstack has published a mitigation rule that blocks attacks until the plugin is updated. Virtual patching is a stopgap, not a fix.
• If an update is not possible, deactivate or remove the plugin.

Exploitation

• Unauthenticated, network-based attack; CVSS attack complexity is high.
• Patchstack expects exploitation and notes that similar flaws are used in mass-exploit campaigns.
• CISA SSVC: exploitation none, not automatable. Not listed in CISA KEV according to Strix.
• No public proof of concept found.

Our recommendation

• Inventory all WordPress sites with AcyMailing and record the exact version.
• Update every affected site to version 11.1.0 or later without delay.
• If an update is not possible, deactivate the plugin or enable a WAF rule.
• Check sites for unexpected PHP files in plugin or upload folders, new administrator accounts and unusual outbound connections; rotate credentials if any are found.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory for CVE-2026-94389 patchstack.com
• Strix: CVE-2026-94389 www.strix.ai
• Vulners: Patchstack entry PATCHSTACK:4DDDCEC5343AA58BCC8CEF267B248895 vulners.com
• Patchstack: AcyMailing vulnerabilities overview patchstack.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:23.