A significant security flaw, tracked as CVE-2026-56292, has been discovered in AcyMailing, a popular newsletter and email marketing extension for both Joomla and WordPress. This vulnerability is an unauthenticated SQL injection, meaning it allows unauthorized access to your website’s database. If your site uses AcyMailing, it’s crucial to update it immediately to version 10.11.1 to protect your data.
An SQL injection vulnerability occurs when an attacker can insert malicious SQL code into input fields on a website. In the case of AcyMailing, a specific part of the extension that can be reached by anyone (even without logging in) was not properly checking information sent to it. This allowed an attacker to craft special requests and force the website to reveal sensitive information stored in its database. This could include usernames, password hashes, and other critical content from your Joomla or WordPress site.
CVE Details
- Product: AcyMailing (for Joomla and WordPress)
- CVE ID: CVE-2026-56292
- Published: July 9, 2026
- Severity: High (CVSS 4.0: 8.7)
- Status: Analyzed
Affected Products
The SQL injection vulnerability impacts AcyMailing versions from 6.0.0 up to and including 10.11.0. This applies to both the Joomla extension and the WordPress plugin. If you are running any version within this range, your site is at risk.
Current Status
The developers of AcyMailing have addressed this critical security issue. The fix was released on July 9, 2026, in version 10.11.1. Sites running this version or newer are protected from this specific vulnerability.
Severity Level
This vulnerability has been rated with a CVSS 4.0 score of 8.7, categorizing it as “High” severity. The reason for this high rating is that an attacker does not need any special privileges or even an account to exploit it (unauthenticated). The attack can be carried out remotely over the network with low complexity, and it can lead to a complete compromise of your database’s confidentiality. While it doesn’t allow an attacker to modify or delete data, the ability to steal sensitive information like password hashes makes it a serious threat.
Possible Solutions
The most important step is to update your AcyMailing installation to version 10.11.1 or later as soon as possible.
- Backup First: Always create a full backup of your website’s files and database before performing any updates. Tools like mySites.guru’s automated backup solutions can ensure you always have a clean restore point.
- Update AcyMailing:
- For Joomla: Go to your Joomla administrator panel, navigate to “System” -> “Update” -> “Extensions.” Look for AcyMailing 10.11.1 and apply the update. If it doesn’t appear, use the “Find Updates” option or manually download the latest package from the AcyMailing website and install it.
- For WordPress: In your WordPress admin, go to “Plugins” -> “Updates” and update AcyMailing to 10.11.1. If it’s not listed, download the updated plugin from your AcyMailing account and upload it via “Plugins” -> “Add New” -> “Upload Plugin.”
For those managing multiple sites, mySites.guru’s mass update feature can help you identify all affected installations and perform bulk updates, simplifying the patching process.
- Verify Version: After updating, confirm that AcyMailing is running version 10.11.1 or higher. mySites.guru’s extension search page can help confirm this across many sites.
- Clear Caches: Clear your website’s cache (Joomla/WordPress, CDN, etc.) to ensure the updated code is being served.
Using a Web Application Firewall (WAF) can offer an additional layer of protection, as WAFs often detect and block SQL injection attempts. Tests showed that popular Joomla WAFs like Admin Tools Professional and RSFirewall! successfully blocked this specific attack. However, a WAF is a mitigation, not a definitive fix. The only true solution is to apply the security patch by updating the extension. If you suspect a breach, utilize tools like mySites.guru’s suspect content tool and follow guides on fixing hacked sites.
References
https://mysites.guru/blog/acymailing-sql-injection-disclosure/
https://www.acymailing.com/
