CVE-2026-120467: Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1
Published Nov 12, 2026
·Updated
Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site.
Event History
Nov 12, 2026
CVE Published
via MITRE·06:03 PM
Data Sourced
via MITRE·06:03 PM
DescriptionWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
Any authenticated user can exploit it, regardless of privilege level.
2
What can an attacker do?
An authenticated attacker can subscribe or unsubscribe another subscriber from any mailing list on the site.
3
Which AcyMailing versions are affected?
The affected version range is AcyMailing 1.0.0 through 11.1.1.