---
id: "CVE-2026-118495"
page: "https://infrastack.ai/live/CVE-2026-118495"
kind: "vulnerability"
aliases: ["CVE-2026-118495"]
title: "AcyMailing: unauthenticated lookup exposes subscriber keys, enabling account actions"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["acymailing", "joomla", "mailing-list", "package", "wordpress"]
not_affected_if: ["no-acymailing", "version-outside-range"]
published_at: "2026-11-12T18:17:16+00:00"
first_seen_at: "2026-11-12T18:40:38+00:00"
updated_at: "2026-11-12T18:42:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118495", "first_seen_at": "2026-11-12T18:40:38+00:00"}]
exploit_sources: []
---

# AcyMailing: unauthenticated lookup exposes subscriber keys, enabling account actions

Link for people: https://infrastack.ai/live/CVE-2026-118495 (this .md is for agents)

AcyMailing, a mailing-list extension for Joomla and WordPress, lets an unauthenticated attacker read a subscriber's record by knowing their email address. The record includes a per-subscriber secret key, which lets the attacker act as that subscriber, including triggering GDPR data export and account deletion where those options are enabled.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed AcyMailing version in the Joomla or WordPress extension manager against the affected range `6.0.0` through `11.1.1`.
- Confirm whether GDPR export or deletion options are enabled in AcyMailing's settings.

## Fix

- AcyMailing versions `6.0.0` through `11.1.1` are affected; the sources do not name a fixed version.

## Timeline

- 2026-11-12T18:40:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118495

## From the sources

Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 through 11.1.1. An unauthenticated attacker who knows a subscriber's email address can read that subscriber's record, including the per-subscriber secret key that authorises the subscription management links. Holding that key, the attacker can act as that subscriber on those endpoints, which includes triggering the GDPR data export and the GDPR account deletion where those options are enabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_