CVE-2026-120466: Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1
Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker who knows a subscriber's email address can unsubscribe that subscriber from one mailing list or from every mailing lists, without proving that the address is theirs. The affected feature also lets an attacker determine whether a given email address belongs to a subscriber of the site.
Event History
Frequently Asked Questions
Which installations are exposed?
AcyMailing versions 1.0.0 through 11.1.1 on Joomla or WordPress are affected. The issue concerns subscription-management functionality.
What does an attacker need to exploit this?
An attacker does not need to authenticate, but must know the target subscriber's email address. They can use it to unsubscribe the target from one list or all mailing lists without proving ownership of the address.
Can this issue disclose subscriber information?
Yes. The affected feature can allow an attacker to determine whether a given email address is registered as a subscriber on the site.