AcyMailing security vulnerabilities

mySites.guru tracks 2 vulnerabilities in com_acym. Every connected Joomla site is checked against them on each audit, and flagged if it runs an affected version.

Check whether your sites are affected

What we check for

CriticalCVE-2026-56292 CVE-2023-39970 CVE-2023-39971 CVE-2023-39972 CVE-2023-39973 CVE-2023-399742026-07-09

AcyMailing (com_acym) below 10.11.1 - Unauthenticated SQL Injection (CVE-2026-56292)

CVE-2026-56292. AcyMailing for Joomla is affected by an unauthenticated SQL injection in a public front-end endpoint. Request parameters were placed into the column list of a SELECT query without sanitising or quoting them (Joomla's text filter strips HTML but does not neutralise SQL syntax), letting an anonymous visitor read data from any table in the site database, including Joomla user accounts and password hashes. No login, account or CSRF token is required. Discovered and responsibly reported to Acyba by mySites.guru (Phil Taylor); fixed in AcyMailing 10.11.1 (released 9 July 2026). A web application firewall that filters SQL (Cloudflare managed rules, Admin Tools, RSFirewall) blocks the payload as mitigation, but the only reliable fix is to update. Update every affected site to 10.11.1 or later. Also covered by this rule: CVE-2023-39970 (unrestricted file upload, RCE), CVE-2023-39971 (XSS), CVE-2023-39972 (unauthorised mailing list creation), CVE-2023-39973 (unauthorised removal of campaign attachments) and CVE-2023-39974 (subscriber count disclosure), all affecting AcyMailing 6.7.0 to 8.6.3. Also within this rule: CVE-2023-28731, CVE-2023-28732 and CVE-2023-28733 (AnyMailing/AcyMailing Joomla plugin below 8.3.0 - unauthenticated RCE via unrestricted upload, missing access control and path traversal on the front-office campaign builder). All three sit inside the 6.0.0 to below-10.11.1 range and need no separate row.

Affected versions: ≥ 6.0.0 and < 10.11.1

Full advisory: our disclosure post

High2026-09-24

AcyMailing (com_acym) below 11.1.0 - Unauthenticated File Deletion (custom file fields) and File Upload (mailbox actions, POP3 mode)

AcyMailing 11.1.0 (24 Sep 2026) fixes two security issues that affect the Enterprise edition; Starter installs contain the same code but cannot reach either feature. 1) File-type custom fields: before 11.1.0 a subscriber could post a plain string as the value of a file field instead of uploading a file, and clearing that field later deleted the stored path without checking it stayed inside the upload folder, allowing path traversal to arbitrary file deletion (for example configuration.php). 2) Mailbox actions and bounce handling using the POP3 (non-IMAP, "pear") connection method: MIME parts from an incoming email were saved to media/com_acym/upload/ without checking their extension against the allowed-files list, so anyone able to email the monitored mailbox could write a file of any type, including PHP, into the web root. No CVE has been published yet. Update to 11.1.0 or later. Temporary mitigation: remove file-type custom fields from public forms and switch the mailbox connection method to IMAP.

Affected versions: < 11.1.0

Full advisory: www.acymailing.com · our disclosure post

What we have written about AcyMailing

AcyMailing 11.1.0 Fixes Two Security Flaws

AcyMailing 11.1.0 fixes a file deletion flaw and a mailbox file-write flaw. No CVE, no post, no announcement: two one-liners under Bug fixes and a hover dot.

24 Sept 2026

Running AcyMailing on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

CVE identifiers: CVE-2026-56292, CVE-2023-39970, CVE-2023-39971, CVE-2023-39972, CVE-2023-39973, CVE-2023-39974. Rules current as of 24 September 2026.