Dashboard / CVE-2026-120469

CVE-2026-120469

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 60/100
Published: 2026-11-12 Modified: 2026-11-13 First seen: 2026-11-12 Status: active

Attack Surface

Network Low Complexity No Auth

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Active
AT: None
VC: None
VI: None
VA: None

Description

Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for phishing under the trusted domain.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
Datasolution AcyMailing extension for Joomla and WordPress 1.0.0-11.1.1
Datasolution AcyMailing extension for Joomla and WordPress 1.0.0-11.1.1
Datasolution AcyMailing extension for Joomla and WordPress 1.0.0-11.1.1

References & Advisories (1)

Bug Bounty Relevance

60 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

5.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

EPSS — Exploitation Probability

0.34%
Raw Score 0.003370
Percentile 27.5%
Date 2026-11-13

Intelligence Sources

mitre ref →
nvd ref →

External Links