Skip to content
OpenAdvisories
High · 8.8 CVE-2026-120466 EUVD-2026-124605GHSA-p4ch-c2vv-v7cp

Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1

Published Nov 12, 2026 · Updated Nov 13, 2026 · Assigned by Joomla

Description

Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker who knows a subscriber's email address can unsubscribe that subscriber from one mailing list or from every mailing lists, without proving that the address is theirs. The affected feature also lets an attacker determine whether a given email address belongs to a subscriber of the site.

Affected products

VendorProductAffectedFixed
Datasolution AcyMailing extension for Joomla and WordPress 1.0.0-11.1.1 —

References