Sensitive Information Exposure in AcyMailing by Acyba
CVE-2026-118495

8.8HIGH

Key Information:

Vendor

WordPress
Status
Acymailing Extension For Joomla And WordPress
Vendor
CVE Published:
12 November 2026

What is CVE-2026-118495?

AcyMailing versions 6.0.0 through 11.1.1 are vulnerable to information exposure, allowing unauthenticated attackers to access sensitive subscriber data. By knowing a subscriber's email address, attackers can read confidential records, including the unique per-subscriber secret key used for subscription management. This key potentially enables attackers to impersonate subscribers, performing actions such as triggering GDPR data exports and account deletions. It is crucial to implement security measures to protect subscriber data from unauthorized access.

Affected Version(s)

AcyMailing extension for Joomla and WordPress 6.0.0-11.1.1

References

https://www.acymailing.com/
product

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

h0rus3c / Ghent University VDP https://vdp.ugent.be
K1nako / Ghent University VDP https://vdp.ugent.be
.