---
id: "CVE-2026-120466"
page: "https://infrastack.ai/live/CVE-2026-120466"
kind: "vulnerability"
aliases: ["CVE-2026-120466"]
title: "AcyMailing for Joomla and WordPress: unsubscribe anyone without authorization"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "AcyMailing", "fixed": [], "affected": ">= 1.0.0, <= 11.1.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["acymailing", "joomla", "mailing-lists", "other", "wordpress"]
not_affected_if: ["not-installed", "version-outside-range"]
published_at: "2026-11-12T18:17:18+00:00"
first_seen_at: "2026-11-12T18:40:38+00:00"
updated_at: "2026-11-12T18:43:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120466", "first_seen_at": "2026-11-12T18:40:38+00:00"}, {"source": "analyst", "url": "https://www.acymailing.com/changelog/", "first_seen_at": "2026-11-12T18:43:45+00:00", "cites": ["https://www.acymailing.com/changelog/", "https://www.acymailing.com/security/"]}]
exploit_sources: []
---

# AcyMailing for Joomla and WordPress: unsubscribe anyone without authorization

Link for people: https://infrastack.ai/live/CVE-2026-120466 (this .md is for agents)

AcyMailing, a mailing list extension for Joomla and WordPress, lets anyone unsubscribe a subscriber from one or all mailing lists knowing only their email address. The same flaw lets an attacker check whether an address belongs to a subscriber of the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:AcyMailing affected >= 1.0.0, <= 11.1.1 fixed no fixed version listed

## How to check

- Joomla: Extensions > Manage > Manage, find AcyMailing and read its version. WordPress: Plugins > Installed Plugins, AcyMailing version.
- Versions 1.0.0 through 11.1.1 are affected per the CVE. No fixed version is published yet (11.1.1 is the latest release in the vendor changelog, 5 Oct 2026); check https://www.acymailing.com/changelog/ for a newer release.

## Timeline

- 2026-11-12T18:40:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120466
- 2026-11-12T18:43:45+00:00 analyst https://www.acymailing.com/changelog/ — No vendor advisory for this CVE found yet on acymailing.com/security (index checked 2026-11-12); changelog's latest is 11.1.1 (Oct 5), which the CVE lists as affected, so no fixed version is published. Fix left unknown; recheck the vendor security page and changelog for 11.1.2+. Endpoint not confirmed (NVD page returned no text); CNA is Joomla (security@joomla.org).

## Documents

- [mentions] AcyMailing changelog (11.1.2) https://www.acymailing.com/changelog/
- [mentions] AcyMailing security advisories index https://www.acymailing.com/security/

## From the sources

Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker who knows a subscriber's email address can unsubscribe that subscriber from one mailing list or from every mailing lists, without proving that the address is theirs. The affected feature also lets an attacker determine whether a given email address belongs to a subscriber of the site.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_