AcyMailing (com_acymailing) below 4.9.5 - Authenticated SQL Injection (CVE-2015-7338)
Affected versions: ≥ 1.1.0 and < 4.9.5
AcyMailing security vulnerabilities
mySites.guru tracks 1vulnerability in com_acymailing. Every connected Joomla site is checked against it on each audit, and flagged if it runs an affected version.
What we check for
What we have written about AcyMailing
Unauthenticated SQL Injection in AcyMailing found by mySites.guru
mySites.guru found and reported CVE-2026-56292, an unauthenticated SQL injection in AcyMailing for Joomla and WordPress. Update to 10.11.1 now.
AcyMailing Vulnerability Also Affects Joomla Sites
CVE-2026-3614 is listed as a WordPress bug. We diffed the 10.8.1 and 10.8.2 source and the same vulnerable code ships to Joomla sites too.
Running AcyMailing on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
CVE identifiers: CVE-2015-7338. Rules current as of 24 August 2026.