AcyMailing <10.11.1 Unauthenticated Blind SQL Injection via subscription[] Parameter

Vulnerability Overview Vulnerability Name: AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter Description: The AcyMailing plugin exposes a front-end controller route ( ) where declares a set of "public" tasks ( ) that run for anonymous visitors, including and . The task reads a list from the request array and passes it unmodified to , which constructs a raw statement by directly concatenating the array into an SQL clause. Vulnerability Details: The array is attacker-controlled and is not cast to integers before being imploded. The value passes through the plugin's general request sanitizer, but converts the input to an array, runs to remove backslashes, and then calls only and strips HTML tags for each element. Since the values in fall within a context, quote-based defenses are explicitly bypassed, leading to unauthenticated SQL injection. CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - 8.2 (High) An attacker can self-register the required subscriber via the public front-end router and use the task. Blind SQL injection allows reading any data from the WordPress database, including hashes and keys/API tokens stored in . The injection is located within a statement; the primary impact is limited integrity impact on the queue table via blind sub-selects. Affected Scope: Plugin Name: AcyMailing (Newsletter, Email Marketing, Automation, SMTP) Affected Versions: <= 10.11.0 Tested Version: 10.11.0 Active Installations: 7,000+ Authentication: None (attackers self-register subscribers via the public task) Prerequisites: Default , , and at least one queued message ( ) for the attacker's subscriber (welcome/follow-up/planned campaign). Remediation: 1. Cast list IDs to integers before imploding, consistent with existing sibling methods: 2. Defense in depth: Construct the sub-select for the statement using with placeholders, and apply element typing (e.g., element mask) via , so array parameters are cast by default. 3. Require an unsubscribe key for each user, so that the operation cannot be driven solely by anonymously self-registered subscribers. Proof of Concept (POC) Automated Testing Observed (baseline 0.043s vs 'SLEEP(5) 5.04s'): Why This Matters Full Database Read, Unauthenticated: Blind sub-selects allow an anonymous attacker to extract any table— password hashes, keys/API tokens, subscriber PII—using boolean/time probes one byte at a time. Credential Theft and Account Takeover: Extracting the hash enables offline cracking; extracting authentication-related keys can enable session/nonce forgery. Large, Active Install Base: With 7,000+ sites running AcyMailing specifically to send campaigns, the queue prerequisite is a common running state. Attack Scenario 1. The attacker POSTs to create a subscriber. 2. If necessary, subscribes to a list with follow-ups so that the queue holds messages. 3. POSTs with a boolean/time payload and reads the database byte-by-byte from the response delay. References CVE: CVE-2026-14920 Classification Type: SQLI

Goal Reached Thanks to every supporter — we hit 100%!

AcyMailing <10.11.1 Unauthenticated Blind SQL Injection via subscription[] Parameter