Executive brief
AcyMailing is a popular WordPress plugin for email marketing and newsletter management, used on over 7,000 sites. A critical SQL injection flaw in its public-facing unsubscribe function allows attackers to read sensitive database information—including user credentials and API keys—without logging in. An attacker only needs to register as a subscriber (the default configuration allows public registration without CAPTCHA) and send a specially crafted request to extract or modify data.
Technical details
This is an unauthenticated SQL injection (CWE-89) in AcyMailing's front-end subscription handler. The vulnerability exists in the `unsubscribe` task (declared as publicly accessible in `FrontusersController.php`), which accepts a `subscription[]` parameter from user input. The plugin passes this array directly into a SQL `IN()` clause via `implode()` without integer coercion, unlike two similar code paths in the same file that correctly call `acym_arrayToInteger()` first. The request sanitizer `acym_getVar()` removes slashes and cleans values, but the cleanup function has no handler for arrays or integers, allowing payloads like `0) UNION SELECT SLEEP(5) FROM DUAL WHERE 1 OR (1` to reach the database query untouched. Attack preconditions are minimal: the default configuration allows visitor self-registration and has CAPTCHA disabled. The injected SQL executes in a `DELETE` statement's sub-select, enabling blind data extraction via time-based or error-based techniques. A patch is available in version 10.11.1.
Affected products
- AcyMailing AcyMailing <= 10.11.0
Timeline
- 2026-08-02: disclosed
- 2026: patched: Fixed in version 10.11.1