Subscriber Identity Vulnerability in AcyMailing Extension for Joomla and WordPress
CVE-2026-120467

7.1HIGH

Key Information:

Vendor

WordPress
Status
Acymailing Extension For Joomla And WordPress
Vendor
CVE Published:
12 November 2026

What is CVE-2026-120467?

The AcyMailing extension for Joomla and WordPress contains a vulnerability that allows authenticated users of any privilege level to indiscriminately subscribe or unsubscribe any other subscriber to or from mailing lists. This flaw compromises the integrity of subscriber management, potentially leading to unauthorized changes in user subscriptions and affecting the overall functionality of email communications on the site.

Affected Version(s)

AcyMailing extension for Joomla and WordPress 1.0.0-11.1.1

References

https://www.acymailing.com/
product

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phil Taylor / mySites.guru
.