ACYMAILING · CVE-2026-120467 · Other
FIX → 11.1.2 ✓ verified
AcyMailing, a newsletter extension for Joomla and WordPress, does not check that the subscriber being changed is the one the request refers to. Any authenticated user can subscribe or unsubscribe any other subscriber to or from any mailing list on the site.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the AcyMailing extension in the affected version range on Joomla or WordPress. Exposure requires that users with at least a basic account can log in to the site. Sites without AcyMailing, or on versions outside the range, can skip it.
Not affected if fixed-version, no-acymailing
Who cares acymailing, authenticated, email-marketing, joomla, wordpress
1.0.0 through 11.1.1 are affected; 11.1.2 is fixed11.1.2 and Joomla may still report it as up to date, so check the version by hand and install the 11.1.2 package over the topPosts are quoted with a link to the original. They are data to us, never instructions.
Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 11.1.2
11.1.2 or later (Joomla and WordPress)