{"id":"CVE-2026-120469","kind":"vulnerability","aliases":["CVE-2026-120469"],"related":[],"title":"AcyMailing extension: open redirect on subscribe and unsubscribe pages","description":"Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for phishing under the trusted domain.","summary":"AcyMailing, a mailing list extension for Joomla and WordPress, has an open redirect on its subscription and unsubscription endpoints. An attacker can craft a link on the affected site that sends visitors to an arbitrary external site, useful for phishing under the trusted domain.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"AcyMailing","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["acymailing","joomla","other","self-hosted","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed AcyMailing version in the Joomla or WordPress extension manager; the affected range is 1.0.0 through 11.1.1.","fix":null,"status":"open","published_at":"2026-11-12T18:17:18+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","triaged_at":"2026-11-12T18:43:05+00:00","updated_at":"2026-11-12T18:43:05+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T18:43:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"AcyMailing extension: open redirect on subscribe and unsubscribe pages","impact":"low","summary":"AcyMailing, a mailing list extension for Joomla and WordPress, has an open redirect on its subscription and unsubscription endpoints. An attacker can craft a link on the affected site that sends visitors to an arbitrary external site, useful for phishing under the trusted domain.","audience":"businesses","category":"other","nicknames":[],"who_cares":["joomla","wordpress","acymailing","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"visitors redirected to attacker sites for phishing under the trusted domain","analyst_note":"","how_to_check":"- Check the installed AcyMailing version in the Joomla or WordPress extension manager; the affected range is 1.0.0 through 11.1.1.\n- unknown for further checks; the sources do not say how to test the endpoints.","plain_action":"","product_name":"AcyMailing","needs_analyst":false,"not_affected_if":[],"who_is_affected":"Sites running the AcyMailing extension in the affected range on a default configuration. The flaw lives in the subscription and unsubscription endpoints, so sites that run AcyMailing for newsletters are the ones to look at. The sources do not say which sites can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000723,"input_tokens":4576,"output_tokens":531,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120469':12A,15A '-2026':11A,14A '1.0.0':82C '11.1.1':83C 'acymail':1A,17B,24B,81C 'acymailing':16A 'acymailing.com':71C 'affect':51B,96C 'arbitrari':58B,104C 'attack':44B,89C 'configur':87C 'craft':46B,91C 'cve':10A,13A 'default':86C 'domain':67B,115C 'endpoint':42B,79C 'extens':2A,28B,70C 'extern':59B,105C 'host':22B 'joomla':18B,30B,68C 'link':48B,93C 'list':27B 'mail':26B 'open':3A,35B,72C 'page':9A 'phish':63B,111C 'redirect':4A,36B,73C,99C 'self':21B 'self-host':20B 'send':54B 'site':52B,60B,97C,106C 'subscrib':6A 'subscript':39B,76C 'trust':66B,114C 'unsubscrib':8A 'unsubscript':41B,78C 'usabl':109C 'use':61B 'visitor':55B,101C 'wordpress':23B,32B,69C","nicknames":[],"mitigations":[],"who_affected":"Sites running the AcyMailing extension in the affected range on a default configuration. The flaw lives in the subscription and unsubscription endpoints, so sites that run AcyMailing for newsletters are the ones to look at. The sources do not say which sites can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["acymailing"],"ptokens":["acymailing"],"labels":["acymailing","joomla","medium","other","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-120469':12A,15A '-2026':11A,14A 'acymail':1A 'acymailing':16A 'cve':10A,13A 'extens':2A 'open':3A 'page':9A 'redirect':4A 'subscrib':6A 'unsubscrib':8A","search_b":"'acymail':17B,24B 'affect':51B 'arbitrari':58B 'attack':44B 'craft':46B 'domain':67B 'endpoint':42B 'extens':28B 'extern':59B 'host':22B 'joomla':18B,30B 'link':48B 'list':27B 'mail':26B 'open':35B 'phish':63B 'redirect':36B 'self':21B 'self-host':20B 'send':54B 'site':52B,60B 'subscript':39B 'trust':66B 'unsubscript':41B 'use':61B 'visitor':55B 'wordpress':23B,32B","search_c":"'1.0.0':82C '11.1.1':83C 'acymail':81C 'acymailing.com':71C 'affect':96C 'arbitrari':104C 'attack':89C 'configur':87C 'craft':91C 'default':86C 'domain':115C 'endpoint':79C 'extens':70C 'extern':105C 'joomla':68C 'link':93C 'open':72C 'phish':111C 'redirect':73C,99C 'site':97C,106C 'subscript':76C 'trust':114C 'unsubscript':78C 'usabl':109C 'visitor':101C 'wordpress':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120469","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120469","severity":null,"published_at":"2026-11-12T18:17:18+00:00","modified_at":"2026-11-12T18:17:18+00:00","first_seen_at":"2026-11-12T18:40:38+00:00","fetched_at":"2026-11-12T18:40:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}