# CVE-2026-14920: AcyMailing unauthenticated SQL injection in subscription parameter

Source: https://junglewise.ai/threats/cve-2026-14920-acymailing-unauthenticated-sql-injection-in-subscription  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-14920 · Severity: high · CVSS 8.2 · Published 2026-08-02

AcyMailing is a popular WordPress plugin for email marketing and newsletter management, used on over 7,000 sites. A critical SQL injection flaw in its public-facing unsubscribe function allows attackers to read sensitive database information—including user credentials and API keys—without logging in. An attacker only needs to register as a subscriber (the default configuration allows public registration without CAPTCHA) and send a specially crafted request to extract or modify data.

## Quick answers

**Is CVE-2026-14920 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14920 being exploited in the wild.

**How severe is CVE-2026-14920?** High severity, with a CVSS score of 8.2, published 2 August 2026.

**Which products and versions are affected?** AcyMailing AcyMailing <= 10.11.0.

**Is there a fix for CVE-2026-14920?** A patch was published on 2026: Fixed in version 10.11.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14920 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-14920?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an unauthenticated SQL injection (CWE-89) in AcyMailing's front-end subscription handler. The vulnerability exists in the `unsubscribe` task (declared as publicly accessible in `FrontusersController.php`), which accepts a `subscription[]` parameter from user input. The plugin passes this array directly into a SQL `IN()` clause via `implode()` without integer coercion, unlike two similar code paths in the same file that correctly call `acym_arrayToInteger()` first. The request sanitizer `acym_getVar()` removes slashes and cleans values, but the cleanup function has no handler for arrays or integers, allowing payloads like `0) UNION SELECT SLEEP(5) FROM DUAL WHERE 1 OR (1` to reach the database query untouched. Attack preconditions are minimal: the default configuration allows visitor self-registration and has CAPTCHA disabled. The injected SQL executes in a `DELETE` statement's sub-select, enabling blind data extraction via time-based or error-based techniques. A patch is available in version 10.11.1.

## Affected products

- AcyMailing AcyMailing <= 10.11.0

## Timeline

- 2026-08-02: disclosed
- 2026: patched: Fixed in version 10.11.1

## References

- [https://wpscan.com/vulnerability/66e61aa1-4e2e-4fe7-b92b-a0d11e4b596f/](https://wpscan.com/vulnerability/66e61aa1-4e2e-4fe7-b92b-a0d11e4b596f/)