WordPress Plugin Vulnerabilities

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress < 11.1.0 - Unauthenticated Remote Code Execution

Description

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 11.0.5. This is due to insufficient validation of user supplied input before it is executed. This makes it possible for unauthenticated attackers to execute arbitrary code on the server.

Affects Plugins

Plugin icon
acymailing
Fixed in 11.1.0

References

CVE
CVE-2026-94389
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/94171811-5c4b-4306-b180-142e09891f50

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
rpgsec
Verified
No
WPVDB ID
c4d3795f-634e-4d39-976c-5baa4976aa7a

Timeline

Publicly Published
2026-09-30 (about 16 days ago)
Added
2026-10-09 (about 8 days ago)
Last Updated
2026-10-16 (about 9 hours ago)

Other

Published
Title
Published
2026-08-04
Title
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels < 6.6.43 - Authenticated (Shop Manager+) Remote Code Execution
Published
2020-05-07
Title
Elementor Pro < 2.9.4 - Authenticated Arbitrary File Upload
Published
2022-04-12
Title
Multiple Plugins from Cool Plugins - Subscriber+ Arbitrary Plugin Installation & Activation
Published
2014-10-12
Title
Work-The-Flow 1.2.1 - Shell Upload
Published
2026-09-21
Title
WP Ultimate Review < 2.4.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter