CVE-2026-56292 Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1

What is CVE-2026-56292?

CVE-2026-56292 is a critical SQL injection vulnerability in acymailing.com AcyMailing extension for Joomla, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage.

Weakness: CWE-89

Which versions are affected by CVE-2026-56292?

It affects 1 product.

Products include Acymailing Acymailing.

How do I fix CVE-2026-56292?

No fix has been published for CVE-2026-56292 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-56292 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56292 exists.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in acymailing.com AcyMailing extension for Joomla

• CVE-2023-28731 Unauthenticated RCE affecting the AcyMailing plugin for Joomla Critical 9.8
• CVE-2026-94132 File upload in AcyMailing Enterprise extension for Joomla Critical 9.5
• CVE-2026-94131 Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 High 8.3
• CVE-2024-7384 AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function High 7.5
• CVE-2023-28733 Stored XSS affecting the AcyMailing plugin for Joomla High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3m45-8387-4837.