{"id":"CVE-2026-120466","kind":"vulnerability","aliases":["CVE-2026-120466"],"related":[],"title":"AcyMailing for Joomla and WordPress: unsubscribe anyone without authorization","description":"Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker who knows a subscriber's email address can unsubscribe that subscriber from one mailing list or from every mailing lists, without proving that the address is theirs. The affected feature also lets an attacker determine whether a given email address belongs to a subscriber of the site.","summary":"AcyMailing, a mailing list extension for Joomla and WordPress, lets anyone unsubscribe a subscriber from one or all mailing lists knowing only their email address. The same flaw lets an attacker check whether an address belongs to a subscriber of the site.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AcyMailing","fixed":[],"affected":">= 1.0.0, <= 11.1.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["acymailing","joomla","mailing-lists","other","wordpress"],"not_affected_if":["not-installed","version-outside-range"],"how_to_check":"- Joomla: Extensions > Manage > Manage, find AcyMailing and read its version. WordPress: Plugins > Installed Plugins, AcyMailing version.\n- Versions 1.0.0 through 11.1.1 are affected per the CVE. No fixed version is published yet (11.1.1 is the latest release in the vendor changelog, 5 Oct 2026); check https://www.acymailing.com/changelog/ for a newer release.","fix":null,"status":"open","published_at":"2026-11-12T18:17:18+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","triaged_at":"2026-11-12T18:42:42+00:00","updated_at":"2026-11-12T18:43:45+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T18:42:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"AcyMailing for Joomla and WordPress: unsubscribe anyone without authorization","impact":"low","summary":"AcyMailing, a mailing list extension for Joomla and WordPress, lets anyone unsubscribe a subscriber from one or all mailing lists knowing only their email address. The same flaw lets an attacker check whether an address belongs to a subscriber of the site.","audience":"businesses","category":"other","nicknames":[],"who_cares":["acymailing","joomla","wordpress","mailing-lists"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"subscribers unsubscribed without consent and subscriber addresses probed","analyst_note":"Find the vendor advisory or NVD page for the fixed version beyond 11.1.1 and confirm the affected endpoint.","how_to_check":"- Check the installed AcyMailing version in the extension manager of the Joomla or WordPress admin.\n- Compare the version against the affected range `1.0.0` to `11.1.1`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-installed","version-outside-range"],"who_is_affected":"Sites running AcyMailing in the affected version range that send mailing lists to subscribers. The flaw needs no account, only a subscriber's email address, and is reachable from the internet through the subscription endpoint. Sites without AcyMailing, or on a version outside the range, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4610,"output_tokens":569,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or NVD page for the fixed version beyond 11.1.1 and confirm the affected endpoint.","search":"'-120466':12A,15A '-2026':11A,14A '1.0.0':77C '11.1.1':78C 'acymail':1A,17B,24B,76C 'acymailing':16A 'acymailing.com':69C 'address':48B,58B,88C,106C,121C 'affect':110C 'also':112C 'anyon':7A,34B 'attack':54B,81C,115C 'author':9A,71C 'belong':59B,122C 'chang':74C 'check':55B 'cve':10A,13A 'determin':116C 'email':47B,87C,120C 'everi':99C 'extens':28B,68C 'featur':111C 'flaw':51B 'given':119C 'joomla':3A,18B,30B,66C 'know':44B,83C 'let':33B,52B,113C 'list':21B,27B,43B,96C,101C 'mail':20B,26B,42B,95C,100C 'mailing-list':19B 'miss':70C 'one':39B,94C 'prove':103C 'site':65B,128C 'subscrib':37B,62B,85C,92C,125C 'subscript':73C 'unauthent':80C 'unsubscrib':6A,35B,90C 'whether':56B,117C 'without':8A,102C 'wordpress':5A,23B,32B,67C","nicknames":[],"mitigations":[],"who_affected":"Sites running AcyMailing in the affected version range that send mailing lists to subscribers. The flaw needs no account, only a subscriber's email address, and is reachable from the internet through the subscription endpoint. Sites without AcyMailing, or on a version outside the range, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["acymailing"],"ptokens":["acymailing"],"labels":["acymailing","high","joomla","mailinglists","other","wordpress"],"campaign_type":null,"search_a":"'-120466':12A,15A '-2026':11A,14A 'acymail':1A 'acymailing':16A 'anyon':7A 'author':9A 'cve':10A,13A 'joomla':3A 'unsubscrib':6A 'without':8A 'wordpress':5A","search_b":"'acymail':17B,24B 'address':48B,58B 'anyon':34B 'attack':54B 'belong':59B 'check':55B 'email':47B 'extens':28B 'flaw':51B 'joomla':18B,30B 'know':44B 'let':33B,52B 'list':21B,27B,43B 'mail':20B,26B,42B 'mailing-list':19B 'one':39B 'site':65B 'subscrib':37B,62B 'unsubscrib':35B 'whether':56B 'wordpress':23B,32B","search_c":"'1.0.0':77C '11.1.1':78C 'acymail':76C 'acymailing.com':69C 'address':88C,106C,121C 'affect':110C 'also':112C 'attack':81C,115C 'author':71C 'belong':122C 'chang':74C 'determin':116C 'email':87C,120C 'everi':99C 'extens':68C 'featur':111C 'given':119C 'joomla':66C 'know':83C 'let':113C 'list':96C,101C 'mail':95C,100C 'miss':70C 'one':94C 'prove':103C 'site':128C 'subscrib':85C,92C,125C 'subscript':73C 'unauthent':80C 'unsubscrib':90C 'whether':117C 'without':102C 'wordpress':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120466","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120466","severity":null,"published_at":"2026-11-12T18:17:18+00:00","modified_at":"2026-11-12T18:17:18+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","fetched_at":"2026-11-12T18:40:38+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120466:3762","url":"https://www.acymailing.com/changelog/","severity":null,"published_at":"2026-11-12T18:43:45+00:00","modified_at":"2026-11-12T18:43:45+00:00","first_seen_at":"2026-11-12T18:43:45+00:00","fetched_at":"2026-11-12T18:43:45+00:00","note":"No vendor advisory for this CVE found yet on acymailing.com/security (index checked 2026-11-12); changelog's latest is 11.1.1 (Oct 5), which the CVE lists as affected, so no fixed version is published. Fix left unknown; recheck the vendor security page and changelog for 11.1.2+. Endpoint not confirmed (NVD page returned no text); CNA is Joomla (security@joomla.org).","cites":["https://www.acymailing.com/changelog/","https://www.acymailing.com/security/"]}],"documents":[{"id":137494,"url":"https://www.acymailing.com/changelog/","title":"AcyMailing changelog (11.1.2)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":137495,"url":"https://www.acymailing.com/security/","title":"AcyMailing security advisories index","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}