Vulnerability · Published Jul 9, 2026 · Assigned by Joomla

CVE-2026-56292Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1

Critical 9.2

In plain English

A critical-severity SQL injection in acymailing.com AcyMailing extension for Joomla from acymailing.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)1.4%top 27.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage.

Affected products (as reported)

Vendor	Product	Versions
acymailing.com	acymailing.com AcyMailing extension for Joomla	1.0-10.11.0

Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H

References

https://www.acymailing.com/ product
https://mysites.guru/blog/acymailing-sql-injection-disclosure/ third-party-advisory