Auth bypass in Datasolution Acymailing Extension For Joomla And WordPress
CVE-2026-120470
Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and campaigns sent to a restricted audience.
Vulnerability class: Broken Access Control
Published · last modified .
EPSS exploit prediction
FIRST.org has not scored this CVE yet. About EPSS.
Affected products
- Datasolution Acymailing Extension For Joomla And WordPress — versions 1.0.0-11.1.1
Weakness classification (CWE)
References
- www.acymailing.com/ (product)