CVE-2026-120469
Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1
Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for phishing under the trusted domain.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
What each source reports
CVE List Score used
Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1
Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for phishing under the trusted domain.
- Record
CVE-2026-120469- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-601
- Updated
- 2026-11-12
EUVDEUVD-2026-124604
Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for phishing under the trusted domain.
- Record
EUVD-2026-124604- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-12
GitHub AdvisoriesGHSA-grqh-vqgx-8p9x
Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and...
Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for phishing under the trusted domain.
- Record
GHSA-grqh-vqgx-8p9x- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-601
- Updated
- 2026-11-12
NVD
Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for phishing under the trusted domain.
- Record
CVE-2026-120469- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-601
- Updated
- 2026-11-12
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-120469 is a medium vulnerability (CVSS 5.1) in Datasolution Acymailing Extension For Joomla And Wordpress, published November 12, 2026. No source lists public exploit code. No source names a fixed version.