CVE-2026-56292
A critical SQL injection vulnerability exists in the AcyMailing extension for Joomla versions older than 10.11.1. Attackers can inject malicious SQL to read or modify database data, potentially exposing sensitive information.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Joomla sites using the AcyMailing extension version below 10.11.1.
Real-world impact
An attacker could read or alter sensitive data stored in the Joomla database, compromising user privacy and site integrity.
Why this severity
The CVSS score of 9.2 reflects the lack of authentication required, remote exploitation, and the high impact on confidentiality, integrity, and availability of the database.
What to do about it
- 01Upgrade the AcyMailing extension to version 10.11.1 or later.
- 02Restart the Joomla site to apply the update.
NVD description indicates that versions below 10.11.1 are vulnerable; upgrading to 10.11.1 or later resolves the issue.
Timeline
- Jul 9, 2026 · 25d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- mysites.guru/blog/acymailing-sql-injecti…exploitthird party advisory
- acymailing.comproduct