Skip to main content
mySites.guru
Free Audit
CriticalA PHP security release fixes two CVSS 9.2 flaws, and PHP 8.1 and older get no patchWhat it means for your site

AcyMailing security vulnerabilities

mySites.guru tracks 1 vulnerability in AcyMailing (com_acymailing), covering 1 CVE. Every connected Joomla site is checked against it on each audit.

Is my site affected?

Your site is affected if it runs AcyMailing in this range:

  • from 1.1.0 up to but not including 4.9.5
Latest safe version
4.9.5 or later. No rule we check matches that release or any newer one.
What to do
Update AcyMailing to 4.9.5 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every AcyMailing vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
CVE-2015-7338from 1.1.0 up to but not including 4.9.54.9.5High2020-03-09

What we check for

HighCVE-2015-73382020-03-09

AcyMailing (com_acymailing) below 4.9.5 - Authenticated SQL Injection (CVE-2015-7338)

AcyMailing 4.x and earlier (the legacy com_acymailing component, before the rename to com_acym at version 6) contain a SQL injection reachable through the exportgeolocorder action via the geolocation_longitude request parameter to index.php. CVSS 7.2 (High). Update to AcyMailing 4.9.5 or later; the supported path is AcyMailing 6+ (com_acym), which is covered by a separate rule. The version_low floor of 1.1.0 is deliberate: the unrelated "Xmap - AcyMailing Integration" plugin by Branko Wilhelm reports element com_acymailing at version 1.0.0 on 18 sites, and match_extension_type is not currently read by the matcher, so the floor is what keeps that plugin out of this rule.

Affected versions: ≥ 1.1.0 and < 4.9.5

Full advisory: nvd.nist.gov

Timeline

  1. 9 March 2020Check added for CVE-2015-7338 (from 1.1.0 up to but not including 4.9.5)
  2. 9 March 2020CVE-2015-7338 record published
  3. 16 April 2026We published: AcyMailing Vulnerability Also Affects Joomla Sites
  4. 9 July 2026We published: Unauthenticated SQL Injection in AcyMailing found by mySites.guru
  5. 24 September 2026We published: AcyMailing 11.1.0 Fixes Two Security Flaws

What we have written about AcyMailing

AcyMailing 11.1.0 Fixes Two Security Flaws

AcyMailing 11.1.0 Fixes Two Security Flaws

AcyMailing 11.1.0 fixes a mailbox file write and a file deletion flaw, now CVE-2026-94132 (9.5 Critical) and CVE-2026-94131, both filed under Bug fixes.

Unauthenticated SQL Injection in AcyMailing found by mySites.guru

Unauthenticated SQL Injection in AcyMailing found by mySites.guru

mySites.guru found and reported CVE-2026-56292, an unauthenticated SQL injection in AcyMailing for Joomla and WordPress. Update to 10.11.1 now.

AcyMailing Vulnerability Also Affects Joomla Sites

AcyMailing Vulnerability Also Affects Joomla Sites

CVE-2026-3614 is listed as a WordPress bug. We diffed the 10.8.1 and 10.8.2 source and the same vulnerable code ships to Joomla sites too.

References

Each CVE page above links its official cve.org record and its NVD entry.

AcyMailing vulnerability questions

Which versions of AcyMailing are vulnerable?
mySites.guru tracks one vulnerability in AcyMailing (com_acymailing). A site is affected if its installed version is in this range: from 1.1.0 up to but not including 4.9.5.
What is the latest safe version of AcyMailing?
4.9.5. Every vulnerability tracked here is fixed by 4.9.5, and no rule we check matches that release or any later one.
How do I check which version of AcyMailing my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_acymailing. mySites.guru reads the installed version on every audit of a connected site and checks it against this rule.

Running AcyMailing on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2015-7338. Rules current as of 24 October 2026.