Authorization Flaw in AcyMailing by Acyba
CVE-2026-120466

8.8HIGH

Key Information:

Vendor

WordPress
Status
Acymailing Extension For Joomla And WordPress
Vendor
CVE Published:
12 November 2026

What is CVE-2026-120466?

An authorization flaw in AcyMailing versions 1.0.0 to 11.1.1 allows unauthenticated attackers to unsubscribe users from mailing lists by knowing the subscriber's email address. This vulnerability not only compromises user preferences but also exposes subscriber information, enabling attackers to verify the existence of email addresses within the system.

Affected Version(s)

AcyMailing extension for Joomla and WordPress 1.0.0-11.1.1

References

https://www.acymailing.com/
product

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phil Taylor / mySites.guru
K1nako / Ghent University VDP https://vdp.ugent.be
.