AcyMailing SMTP Newsletter: Unauthenticated arbitrary file deletion

Summary

The WordPress plugin AcyMailing SMTP Newsletter up to and including version 11.0.5 contains an access control flaw that allows unauthenticated users to delete arbitrary files on the server. An attacker can send a crafted request without logging in, which can remove important files such as configuration or core files and break the website. The attack requires no user interaction, so any internet-reachable WordPress site with the affected plugin is exposed.

Affected

• AcyMailing SMTP Newsletter WordPress plugin (package acymailing) up to and including 11.0.5

Fixed in

• Update to version 11.1.0 or later (vendor and Patchstack list 11.1.0 as the patched version; 11.1.1 is the latest release seen in research).
• The exact fixed version for this CVE is not confirmed in the sources.

Workaround

• Patching is the fix. Patchstack may offer virtual-patching rules, but none was confirmed for this CVE.
• If you cannot patch immediately, disable the plugin until the update is applied.
• Back up the website and file system before making changes.

Exploitation

• Patchstack classifies the flaw as high priority and expects exploitation; CISA SSVC lists exploitation as none and automatable as yes.
• No public proof of concept or confirmed exploitation was found in the sources.

Our recommendation

• Update AcyMailing to version 11.1.1 or the latest available version immediately on all WordPress sites.
• Check whether the plugin is installed on any internet-facing site, including old campaign sites.
• If patching is delayed, disable the plugin and monitor the site for missing or changed files.
• Review other AcyMailing 2026 advisories and keep the plugin on a current version.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory CVE-2026-95588 patchstack.com
• Patchstack AcyMailing vulnerabilities overview patchstack.com
• CVE record mirror (threatint) cve.threatint.com
• Strix CVE-2026-95588 www.strix.ai
• AcyMailing changelog www.acymailing.com
• AcyMailing on WordPress.org wordpress.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:28.