CVE-2026-120469: Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1
Published Nov 12, 2026
·Updated
Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for phishing under the trusted domain.
Event History
Nov 12, 2026
CVE Published
via MITRE·05:57 PM
Data Sourced
via MITRE·05:57 PM
DescriptionWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Are sites using the default configuration exposed?
Yes. The open redirect is present on a default configuration of affected AcyMailing versions.
2
What does an attacker need to exploit this issue?
An attacker needs to craft a link on the affected site that causes a visitor to be redirected to an arbitrary external site. This can support phishing by using the trusted site domain in the link.
3
Which endpoints are affected?
The subscription and unsubscription endpoints are affected.