Auth bypass in Datasolution Acymailing Extension For Joomla And WordPress

CVE-2026-120467

Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site.

Vulnerability class: IDOR (Insecure Direct Object Reference)

Published · last modified .

EPSS exploit prediction

FIRST.org has not scored this CVE yet. About EPSS.

Affected products

Weakness classification (CWE)

References