CVE-2026-56292
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A SQL Injection vulnerability in the AcyMailing extension for Joomla versions below 10.11.1 allows unauthorized database access and data leakage.
Risk Assessment
An attacker can access sensitive data stored in the Joomla database, including user data and configuration.
Recommendation
Update the AcyMailing extension to version 10.11.1 or later.
Other vulnerabilities in AcyMailing
See all- CVE-2026-15426High
The AcyMailing plugin for WordPress up to version 10.11.1 has an authorization bypass vulnerability. An authenticated attacker with subscriber-level access can overwrite the BCC field of the acy_notification_cms notification template, causing WordPress password reset emails, including those for administrators, to be silently copied to an attacker-controlled address, enabling account takeover.
- CVE-2026-12170Medium
The AcyMailing plugin for WordPress up to version 10.10.2 is vulnerable to Stored Cross-Site Scripting via the 'alignment' attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute whenever a user accesses an injected page.
Original NVD description (English source)
Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage.