CVE-2026-57739

CriticalCVSS 9.3/10Last modified Oct 24, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through <= 10.11.0.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
AcyMailing Newsletter Team	AcyMailing SMTP Newsletter	<= 10.11.0

References

https://patchstack.com/database/Wordpress/Plugin/acymailing/vulnerability/wordpress-acymailing-smtp-newsletter-plugin-10-10-2-sql-injection-vulnerability?_s_id=cve

Timeline

Published: Jul 13, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-57746.4Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user CVE-2026-577407.1Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Exploiting Incorrectly Config CVE-2026-577417.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AcyMailing Newsletter Team AcyMailing CVE-2026-577427.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Refl CVE-2026-577438.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 CVE-2026-577449.8Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affect CVE-2026-577457.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-e CVE-2026-577467.1Subscriber Broken Access Control in Booked <= 3.0.0 versions.CVE-2026-577476.5Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions.CVE-2026-577487.5Contributor Local File Inclusion in Shopify <= 1.0.0 versions.CVE-2026-577497.5Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions.CVE-2026-577505.3Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions.