LoginSign Up
← Back to all sparks
A

AcyMailing

MKT AUTO
Velocity5.0

Email marketing and newsletter platform for WordPress and Joomla

www.acymailing.com ↗

AcyMailing spent its 11.0 cycle on privacy plumbing and a security rewrite, not features.

email-marketinggdpr-compliancesecurity-hardeningself-hostedconsent-controlspatch-cycle
◆Current state
AcyMailing crossed into 11.0 at the end of July, and the release carried a reworked codebase aimed at security plus a GDPR-driven option for handling pixel tracking. The two follow-up patches since have been almost entirely corrective — automations display, followup creation, multilingual campaigns, and restoring the pot file that custom translations depend on. The 10.11 line before it patched an SQL injection and added toggles for IP collection and a statistics recording delay.
◆Where it's heading
This is a mature self-hosted mailer working through compliance and hardening rather than chasing capability. The consistent thread across both version lines is giving administrators switches for data they previously collected by default — open-tracking pixels, IP addresses on subscription, statistics timing. The rapid 11.0.1 and 11.0.2 patches suggest the codebase rework shook loose regressions the major release did not catch.
◆Prediction
Expect the 11.0.x patch stream to continue for a few more releases as rework regressions surface, before any new functionality appears. The entries give no signal about what the next feature cycle targets.

◆Recent moves

  1. 2d ago

    Fixes for automations, followups and multilingual campaigns

    A pure corrective patch two days after 11.0.1, clearing broken field display in automations, blocked followup creation, and an error when creating a campaign with multilingual enabled. All three read as fallout from the 11.0.0 codebase rework rather than new problems.

  2. 3d ago

    Consent option in form preview, Loco Translate support restored

    Surfaces the tracking consent option in the subscription form editor preview and restores the pot file so Loco Translate can drive custom translations again. The pot file restoration matters more than it sounds — its absence in 11.0.0 silently broke translation workflows for self-hosted operators.

  3. 9d ago

    GDPR pixel-tracking option and a full codebase security rework

    The 11.0 major pairs a GDPR-aligned option for pixel tracking with a security-motivated rework of the entire extension codebase. It sets up the compliance-and-hardening posture the whole cycle follows, and explains the patch traffic that immediately follows it.

  4. 1mo ago

    SQL injection vulnerability patched

    An SQL injection patch shipped on its own with an explicit recommendation to update. Releasing it as a standalone version rather than folding it into the next feature drop is the right call for a self-hosted extension where operators control their own upgrade timing.

  5. 1mo ago

    IP-collection toggle and configurable statistics delay

    Adds an on/off toggle for IP address collection at confirmation and subscription, plus a configurable delay before statistics start recording. Both are the same move the 11.0 pixel option makes — handing operators a switch for data the plugin used to gather unconditionally.

  6. 1mo ago

    Timezone bug that blocked send and click statistics

    A single timezone fix affecting send, open and click statistics, which in some configurations were not being collected at all. Narrow, though anyone hit by it would have been reading empty campaign reports without knowing why.