Executive brief
AcyMailing, a popular email marketing and newsletter tool for Joomla and WordPress, contains a security flaw that allows unauthorized access to the website's database. An attacker can exploit this to steal sensitive information, including user account details, password hashes, and private site content. This vulnerability does not require a login, meaning any anonymous visitor can potentially access the data. Organizations should update to version 10.11.1 immediately to protect their customer data and site integrity.
Technical details
An unauthenticated SQL injection vulnerability exists in AcyMailing versions 6.0.0 through 10.11.0 for both Joomla and WordPress. The flaw is located in a public front-end endpoint that accepts request parameters and inserts them directly into the column list of a SQL SELECT query without proper sanitization or quoting. While the extension utilized Joomla's standard text filter, this only stripped HTML and failed to neutralize SQL syntax. An attacker can supply crafted parameters to execute arbitrary queries, enabling the extraction of sensitive data such as the 'wp_users' or Joomla user tables. The issue is resolved in version 10.11.1.
Affected products
- acymailing.com AcyMailing extension for Joomla 6.0.0 - 10.11.0
- acymailing.com AcyMailing plugin for WordPress 6.0.0 - 10.11.0
Timeline
- 2026-07-09: patched: Version 10.11.1 released to address the vulnerability.
- 2026-07-09: disclosed: Public disclosure by mySites.guru.
- 2026-07-09: advisory: CVE-2026-56292 published.