AcyMailing vulnerabilities
3 known CVE vulnerabilities in AcyMailing, translated and rated.
- CVE-2026-15426High
The AcyMailing plugin for WordPress up to version 10.11.1 has an authorization bypass vulnerability. An authenticated attacker with subscriber-level access can overwrite the BCC field of the acy_notification_cms notification template, causing WordPress password reset emails, including those for administrators, to be silently copied to an attacker-controlled address, enabling account takeover.
- CVE-2026-56292High
A SQL Injection vulnerability in the AcyMailing extension for Joomla versions below 10.11.1 allows unauthorized database access and data leakage.
- CVE-2026-12170Medium
The AcyMailing plugin for WordPress up to version 10.10.2 is vulnerable to Stored Cross-Site Scripting via the 'alignment' attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute whenever a user accesses an injected page.