CVE-2023-28731 Unauthenticated RCE affecting the AcyMailing plugin for Joomla
Unauthenticated attackers can achieve remote code execution via unrestricted file upload if campaign creation is enabled on the front-office.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-28731?
CVE-2023-28731 is a critical vulnerability in AcyMailing Newsletter Plugin for Joomla in the Enterprise version, published on 30 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected.
This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.
Which versions are affected by CVE-2023-28731?
It affects 1 product.
Products include Acymailing Acymailing.
How do I fix CVE-2023-28731?
No fix has been published for CVE-2023-28731 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-28731 being exploited?
There is no known exploitation of CVE-2023-28731 in the wild and no public exploit code.
Other vulnerabilities in AcyMailing Newsletter Plugin for Joomla in the Enterprise version
- CVE-2026-94132 File upload in AcyMailing Enterprise extension for Joomla
- CVE-2026-56292 Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1
- CVE-2026-94131 Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0
- CVE-2024-7384 AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function
- CVE-2023-28733 Stored XSS affecting the AcyMailing plugin for Joomla
Sources
Also known as GHSA-2qgx-8w4f-jc5v.