Dashboard / CVE-2026-120467

CVE-2026-120467

HIGH
MEDIUM Priority: 0.02 BB Relevance: 64/100
Published: 2026-11-12 Modified: 2026-11-13 First seen: 2026-11-12 Status: active

Attack Surface

Network Low Complexity No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: None
VI: High
VA: None

Description

Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
Datasolution AcyMailing extension for Joomla and WordPress 1.0.0-11.1.1
Datasolution AcyMailing extension for Joomla and WordPress 1.0.0-11.1.1
Datasolution AcyMailing extension for Joomla and WordPress 1.0.0-11.1.1

References & Advisories (1)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.28%
Raw Score 0.002790
Percentile 20.6%
Date 2026-11-13

Intelligence Sources

mitre ref →
nvd ref →

External Links