LoginSign Up
← Back to all sparks
A

AcyMailing

MKT AUTO
Velocity2.5

Email marketing and newsletter platform for WordPress and Joomla

www.acymailing.com ↗

AcyMailing 11.1.2 closes holes that let strangers read or unsubscribe any subscriber.

email-marketingjoomlasecuritygdprprivacy
◆Current state
AcyMailing is a Joomla and WordPress email marketing extension. Release 11.1.2 is a security update: it fixes an unauthenticated leak of subscriber data including the subscriber key, anonymous unsubscribing of any known address, logged-in users changing other people's subscriptions, unchecked post-subscription redirects and campaign archive pages opening without permission. It follows 11.1's privacy work, a per-subscriber tracking switch and fixed one-click unsubscribe.
◆Where it's heading
Since the 11.0 security rework in July, AcyMailing's releases alternate between privacy features and fixes for flaws in how subscriber actions are authorized. 11.1.2 shows the 11.0 rework left gaps in the subscription paths, now patched with ownership checks and security tokens.
◆Prediction
A security advisory with full details is promised once users have had time to update, and further 11.1.x patches are likely as those details invite scrutiny of related code paths.

◆Recent moves

  1. 2d ago

    AcyMailing 11.1.2 fixes subscriber data leak and forced unsubscribes

    Three high-severity fixes stop anonymous visitors from reading subscriber data or unsubscribing anyone whose address they know, and stop logged-in users from changing other people's subscriptions. Redirects now need an approved host. It patches the subscription paths the 11.0 security rework did not fully cover; site owners should update now.

  2. 1mo ago

    AcyMailing 11.1.1

    Lighter emails through the AcyMailing sending service, no HTML in custom field values, clearer OAuth failure messages, and bounce handling that no longer stops on one unreadable message. A cleanup release that also tightens input handling.

  3. 1mo ago

    AcyMailing 11.1.0

    11.1.0 lets every subscriber manage tracking preferences from their profile and restores one-click unsubscribe, a deliverability requirement for bulk mail. It also ships security hardening for custom fields and mailbox actions.

  4. 2mo ago

    AcyMailing 11.0.5

    11.0.5 adds anonymized statistics — global open/click/send counts without individual subscriber tracking — a meaningful GDPR feature for operators who want analytics without personal data storage. CSS/JS override and accessibility improvements also land.

  5. 2mo ago

    AcyMailing 11.0.4

    11.0.4 patches pie chart display issues, captcha duplication on Joomla forms, and fixes to add-on date insertion for EasyBlog and K2. Minor security improvement on bounce handling. No new capabilities.

  6. 3mo ago

    AcyMailing 11.0.3

    11.0.3 adds REST API error messaging for invalid list usage and improves module insertion performance. Bug fixes for automation conditions and file field behavior. Incremental stabilization of the v11 launch.