Visibility Issue in AcyMailing for Joomla and WordPress
CVE-2026-120470

6.9MEDIUM

Key Information:

Vendor

WordPress
Status
Acymailing Extension For Joomla And WordPress
Vendor
CVE Published:
12 November 2026

What is CVE-2026-120470?

AcyMailing for Joomla and WordPress has a vulnerability allowing unauthenticated attackers to access the online versions of email campaigns that were meant to be private. This includes campaigns that were never intended for public visibility as well as those that were unpublished after being sent. The flaw presents a significant risk as sensitive information can be exposed without adequate security checks.

Affected Version(s)

AcyMailing extension for Joomla and WordPress 1.0.0-11.1.1

References

https://www.acymailing.com/
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phil Taylor / mySites.guru
.