CVE-2026-120470 · Other
NO FIX YET · SEE WHAT TO DO
AcyMailing, an email newsletter extension for Joomla and WordPress, lets anyone without an account read the online version of campaigns that were never made public. This includes campaigns unpublished after sending and campaigns sent only to a restricted audience.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the AcyMailing extension for Joomla or WordPress in versions 1.0.0 through 11.1.1. Exposure is about campaign content that was sent to a restricted audience or unpublished after sending; sites that only send public campaigns have less to lose. The sources do not say whether a default configuration is exposed.
Not affected if not-running-acymailing, version-above-11.1.1
Who cares acymailing, email-marketing, joomla, wordpress
1.0.0 through 11.1.1 are listed as affected.11.1.1; the sources do not name the exact fixed release.Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and campaigns sent to a restricted audience.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.