---
id: "CVE-2026-120470"
page: "https://infrastack.ai/live/CVE-2026-120470"
kind: "vulnerability"
aliases: ["CVE-2026-120470"]
title: "AcyMailing: unpublished email campaigns readable without any login"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["acymailing", "email-marketing", "joomla", "other", "wordpress"]
not_affected_if: ["not-running-acymailing", "version-above-11.1.1"]
published_at: "2026-11-12T18:17:18+00:00"
first_seen_at: "2026-11-12T18:40:38+00:00"
updated_at: "2026-11-12T18:42:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120470", "first_seen_at": "2026-11-12T18:40:38+00:00"}]
exploit_sources: []
---

# AcyMailing: unpublished email campaigns readable without any login

Link for people: https://infrastack.ai/live/CVE-2026-120470 (this .md is for agents)

AcyMailing, an email newsletter extension for Joomla and WordPress, lets anyone without an account read the online version of campaigns that were never made public. This includes campaigns unpublished after sending and campaigns sent only to a restricted audience.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed AcyMailing version in the Joomla or WordPress extension manager; versions `1.0.0` through `11.1.1` are listed as affected.
- Try opening an old or unpublished campaign's online (web) version link while logged out.

## Fix

- Move to a version newer than `11.1.1`; the sources do not name the exact fixed release.

## Timeline

- 2026-11-12T18:40:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120470

## From the sources

Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and campaigns sent to a restricted audience.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_