Is CVE-2026-56292 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56292 being exploited in the wild.

How severe is CVE-2026-56292?

Informational severity, with a CVSS score of 9.2, published 9 July 2026.

Which products and versions are affected?

Acyba AcyMailing extension for Joomla 6.0.0 - 10.11.0; Acyba AcyMailing plugin for WordPress 6.0.0 - 10.11.0.

Is there a fix for CVE-2026-56292?

A patch was published on 2026-07-09: Version 10.11.1 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56292 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56292?

Check whether you run Acyba AcyMailing extension for Joomla or Acyba AcyMailing plugin for WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56292: AcyMailing unauthenticated SQL injection in Joomla and WordPress extensions

CVE-2026-56292 · Severity: info · CVSS 9.2 · Published 2026-07-09

AcyMailing, a popular email marketing and newsletter tool for Joomla and WordPress, contains a security flaw that allows unauthorized access to the website's database. An attacker can exploit this to steal sensitive information, including user account details, password hashes, and private site content. This vulnerability does not require a login, meaning any anonymous visitor can potentially access the data. Organizations should update to version 10.11.1 immediately to protect their customer data and site integrity.

Vendors: Acyba.

Quick answers

Is CVE-2026-56292 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56292 being exploited in the wild.
How severe is CVE-2026-56292?: Informational severity, with a CVSS score of 9.2, published 9 July 2026.
Which products and versions are affected?: Acyba AcyMailing extension for Joomla 6.0.0 - 10.11.0; Acyba AcyMailing plugin for WordPress 6.0.0 - 10.11.0.
Is there a fix for CVE-2026-56292?: A patch was published on 2026-07-09: Version 10.11.1 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56292 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56292?: Check whether you run Acyba AcyMailing extension for Joomla or Acyba AcyMailing plugin for WordPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unauthenticated SQL injection vulnerability exists in AcyMailing versions 6.0.0 through 10.11.0 for both Joomla and WordPress. The flaw is located in a public front-end endpoint that accepts request parameters and inserts them directly into the column list of a SQL SELECT query without proper sanitization or quoting. While the extension utilized Joomla's standard text filter, this only stripped HTML and failed to neutralize SQL syntax. An attacker can supply crafted parameters to execute arbitrary queries, enabling the extraction of sensitive data such as the 'wp_users' or Joomla user tables. The issue is resolved in version 10.11.1.

Affected products

acymailing.com AcyMailing extension for Joomla 6.0.0 - 10.11.0
acymailing.com AcyMailing plugin for WordPress 6.0.0 - 10.11.0

Timeline

2026-07-09: patched: Version 10.11.1 released to address the vulnerability.
2026-07-09: disclosed: Public disclosure by mySites.guru.
2026-07-09: advisory: CVE-2026-56292 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.