Filtered by vendor Datasolution Subscriptions
Filtered by product Acymailing Extension For Joomla And Wordpress Subscriptions

Search

Switch to Advanced Search (Beta)
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-118495 2 Datasolution, Wordpress-extensions 2 Acymailing Extension For Joomla And Wordpress, Acy Mailing 2026-11-15 N/A
Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 through 11.1.1. An unauthenticated attacker who knows a subscriber's email address can read that subscriber's record, including the per-subscriber secret key that authorises the subscription management links. Holding that key, the attacker can act as that subscriber on those endpoints, which includes triggering the GDPR data export and the GDPR account deletion where those options are enabled.
CVE-2026-120469 2 Datasolution, Wordpress-extensions 2 Acymailing Extension For Joomla And Wordpress, Acymailing 2026-11-15 N/A
Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for phishing under the trusted domain.
CVE-2026-120466 2 Datasolution, Wordpress-extensions 2 Acymailing Extension For Joomla And Wordpress, Acymailing.com 2026-11-15 N/A
Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker who knows a subscriber's email address can unsubscribe that subscriber from one mailing list or from every mailing lists, without proving that the address is theirs. The affected feature also lets an attacker determine whether a given email address belongs to a subscriber of the site.
CVE-2026-120470 2 Datasolution, Wordpress-extensions 2 Acymailing Extension For Joomla And Wordpress, Acymailing 2026-11-15 N/A
Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and campaigns sent to a restricted audience.
CVE-2026-120467 3 Acymailing, Datasolution, Wordpress-extensions 3 Acymailing, Acymailing Extension For Joomla And Wordpress, Acymailing 2026-11-15 N/A
Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site.