Auth bypass in Datasolution Acymailing Extension For Joomla And WordPress

CVE-2026-120466

Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker who knows a subscriber's email address can unsubscribe that subscriber from one mailing list or from every mailing lists, without proving that the address is theirs. The affected feature also lets an attacker determine whether a given email address belongs to a subscriber of the site.

Vulnerability class: Broken Access Control

Published · last modified .

EPSS exploit prediction

FIRST.org has not scored this CVE yet. About EPSS.

Affected products

Weakness classification (CWE)

References