[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f97iApeZffkQMNlsQ3LklLcnfpKRGwOwbONjlXJThnbg":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-57739","acymailing-an-ultimate-newsletter-plugin-and-marketing-automation-solution-for-wordpress-unauthenticated-sql-injection","AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress \u003C= 10.11.0 - Unauthenticated SQL Injection","The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 10.11.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","acymailing",null,"\u003C=10.11.0","10.11.1","high",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-06 00:00:00","2026-07-14 19:54:47",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fab3baeb6-8728-46af-89ad-33811ead84b0?source=api-prod",9,[22,23,24,25,26,27,28,29],"back\u002FClasses\u002FActionClass.php","back\u002FClasses\u002FCampaignClass.php","back\u002FClasses\u002FFieldClass.php","back\u002FClasses\u002FFollowupClass.php","back\u002FClasses\u002FListClass.php","back\u002FClasses\u002FMailClass.php","back\u002FClasses\u002FUserClass.php","back\u002FControllers\u002FDashboardController.php","researched",false,3,"# Vulnerability Research Plan: CVE-2026-57739 (AcyMailing SQL Injection)\n\n## 1. Vulnerability Summary\nThe **AcyMailing** plugin (\u003C= 10.11.0) is vulnerable to an **unauthenticated SQL Injection** via the `element_tab` parameter. The vulnerability occurs in `MailClass::getMatchingElements` (and potentially `CampaignClass::getMatchingElements`) where user-supplied input is concatenated into a SQL `JOIN` clause or `WHERE` filter without sufficient preparation using `$wpdb->prepare()` or identifier escaping. Specifically, the code uses `acym_escape()` (which often only performs HTML escaping) on a string used as a column identifier in a `LEFT JOIN`.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **Action:** `acym_ajax`\n- **Control\u002FTask:** `ctrl=frontnewsletters&task=listing` (Unauthenticated front-end archive view)\n- **Vulnerable Parameter:** `element_tab`\n- **Authentication:** Unauthenticated (via `wp_ajax_nopriv_acym_ajax`)\n- **Preconditions:** The plugin must be active. A valid AJAX nonce for the `acym_ajax` action is required (obtainable from any page enqueuing AcyMailing scripts).\n\n## 3. Code Flow\n1. **Entry Point:** An unauthenticated user sends a POST request to","The AcyMailing plugin for WordPress is vulnerable to unauthenticated SQL Injection because it fails to properly escape and validate user-supplied input, specifically the 'element_tab' parameter and other internal settings, before concatenating them into SQL queries. This allows an attacker to manipulate the query structure, potentially leading to the extraction of sensitive data from the database.","\u002F\u002F back\u002FClasses\u002FMailClass.php (line 159-161)\nif (!empty($settings['element_tab'])) {\n    $statJoin = ' LEFT JOIN #__acym_mail_stat AS mail_stat ON mail.id = mail_stat.mail_id ';\n    $listJoin = acym_isAdmin() ? '' : ' LEFT JOIN #__acym_list AS list ON list.'.acym_escape($settings['element_tab']).'_id = mail.id';\n    $query = 'SELECT DISTINCT mail.*, mail_stat.sent as subscribers, mail_stat.open_unique FROM #__acym_mail AS mail'.$statJoin.$tagJoin.$listJoin;\n    $filters[] = 'mail.type = '.acym_escapeDB($settings['element_tab']);\n}\n\n---\n\n\u002F\u002F back\u002FClasses\u002FFieldClass.php (line 132-134)\n$query = 'SELECT '.acym_secureDBColumn($fieldDB->value).' AS value, '.acym_secureDBColumn($fieldDB->title).' AS title\n            FROM `'.acym_secureDBColumn($fieldDB->database).'`.`'.acym_secureDBColumn($fieldDB->table).'`';\n$query .= isset($fieldDB->where_value) && strlen($fieldDB->where_value) > 0 ? ' WHERE `'.acym_secureDBColumn($fieldDB->where).'` '.$fieldDB->where_sign.' '.acym_escapeDB(\n        $fieldDB->where_value\n    ) : '';\n\n---\n\n\u002F\u002F back\u002FClasses\u002FActionClass.php (line 119)\npublic function getActionsByAutomationId(int $id): array\n{\n    $actions = acym_loadObjectList(\n        'SELECT action.* \n        FROM `#__acym_action` AS `action` \n        JOIN `#__acym_condition` AS `condition` \n            ON `action`.`condition_id` = `condition`.`id` \n        JOIN `#__acym_step` AS `step` \n            ON `condition`.`step_id` = `step`.`id` \n        WHERE `step`.`automation_id` = '.$id\n    );\n    array_map([$this, 'fixTypes'], $actions);\n\n    return $actions;\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facymailing\u002F10.11.0\u002Fback\u002FClasses\u002FActionClass.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facymailing\u002F10.11.1\u002Fback\u002FClasses\u002FActionClass.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facymailing\u002F10.11.0\u002Fback\u002FClasses\u002FActionClass.php\t2025-11-17 10:05:56.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facymailing\u002F10.11.1\u002Fback\u002FClasses\u002FActionClass.php\t2026-07-09 12:25:14.000000000 +0000\n@@ -116,7 +116,7 @@\n                 ON `action`.`condition_id` = `condition`.`id` \n             JOIN `#__acym_step` AS `step` \n                 ON `condition`.`step_id` = `step`.`id` \n-            WHERE `step`.`automation_id` = '.$id\n+            WHERE `step`.`automation_id` = '.intval($id)\n         );\n         array_map([$this, 'fixTypes'], $actions);\n \n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facymailing\u002F10.11.0\u002Fback\u002FClasses\u002FMailClass.php\t2025-11-19 11:37:16.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Facymailing\u002F10.11.1\u002Fback\u002FClasses\u002FMailClass.php\t2026-07-09 12:25:14.000000000 +0000\n@@ -157,9 +157,14 @@\n         }\n \n         if (!empty($settings['element_tab'])) {\n-            $statJoin = ' LEFT JOIN #__acym_mail_stat AS mail_stat ON mail.id = mail_stat.mail_id ';\n-            $listJoin = acym_isAdmin() ? '' : ' LEFT JOIN #__acym_list AS list ON list.'.acym_escape($settings['element_tab']).'_id = mail.id';\n-            $query = 'SELECT DISTINCT mail.*, mail_stat.sent as subscribers, mail_stat.open_unique FROM #__acym_mail AS mail'.$statJoin.$tagJoin.$listJoin;\n+            $query = 'SELECT DISTINCT mail.*, mail_stat.sent as subscribers, mail_stat.open_unique FROM #__acym_mail AS mail';\n+            $query .= ' LEFT JOIN #__acym_mail_stat AS mail_stat ON mail.id = mail_stat.mail_id ';\n+            if (!empty($settings['tag'])) {\n+                $query .= ' JOIN #__acym_tag AS tag ON mail.id = tag.id_element ';\n+            }\n+            if (!acym_isAdmin()) {\n+                $query .= ' LEFT JOIN #__acym_list AS list ON list.'.acym_secureDBColumn($settings['element_tab']).'_id = mail.id';\n+            }\n             $filters[] = 'mail.type = '.acym_escapeDB($settings['element_tab']);\n         }","The exploit targets the AJAX endpoint `\u002Fwp-admin\u002Fadmin-ajax.php`. An attacker sends a POST request with the action `acym_ajax` and parameters `ctrl=frontnewsletters`, `task=listing`, and `element_tab`. Because `MailClass::getMatchingElements` handles this input in a non-administrative context and concatenates it directly into a `LEFT JOIN` column name suffix, an attacker can break out of the column identifier context. By providing a payload like `id -- ` or using UNION-based techniques in the `element_tab` parameter, the attacker can execute arbitrary SQL queries. No authentication is required for this specific AJAX task if the `wp_ajax_nopriv` hook is registered, which it is for frontend newsletter archives.","gemini-3-flash-preview","2026-07-25 09:23:23","2026-07-25 09:24:48",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","10.11.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Facymailing\u002Ftags\u002F10.11.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Facymailing.10.11.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Facymailing\u002Ftags\u002F10.11.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Facymailing.10.11.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Facymailing\u002Ftags"]