What is the CVSS score of CVE-2026-39530?

CVE-2026-39530 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of SpeakOut! Email Petitions are affected by CVE-2026-39530?

Organizations running the SpeakOut! Email Petitions WordPress plugin (versions ≤ 4.6.5) face critical risk from an unauthenticated SQL injection vulnerability (CVE-2026-39530, CVSS 9.3) that allows…

How to fix or mitigate CVE-2026-39530?

Within 24 hours: Conduct inventory of all WordPress instances to identify any running SpeakOut! Email Petitions plugin version 4.6.5 or earlier; immediately deactivate the plugin or isolate affected systems from the public internet. Within 7 days: Uninstall the SpeakOut! plugin entirely and deploy an alternative email campaign solution; validate removal on all systems. Within 30 days: Because no vendor-released patch has been identified at time of analysis, confirm complete removal from all systems; implement WAF rules to detect SQL injection patterns and enable database query monitoring to identify any exploitation that may have occurred pre-removal.

SpeakOut! Email Petitions CVE-2026-39530

EUVD-2026-36960 CRITICAL

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-cmrg-m5w9-wc4f

WordPress SQLi Wordpress Plugin Speakout Email Petitions

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.9 CRITICAL

Network-reachable WordPress plugin endpoint, unauthenticated SQLi (PR:N, AC:L); scope change to DB; I raised to L since SQLi rarely leaves integrity fully intact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:19 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.

AnalysisAI

Unauthenticated SQL injection in the SpeakOut! Email Petitions WordPress plugin (versions ≤ 4.6.5) allows remote attackers to inject arbitrary SQL into backend database queries without credentials or user interaction. Reported by Patchstack and tracked as EUVD-2026-36960, the flaw carries a CVSS 3.1 score of 9.3 driven by a changed scope and network-reachable attack surface. No public exploit identified at time of analysis, but the trivial exploitability and WordPress plugin ecosystem make opportunistic mass-scanning likely.

Technical ContextAI

SpeakOut! Email Petitions is a WordPress plugin that lets site operators run online petition campaigns with email-based signature collection. The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect: user-controlled input is concatenated into a SQL statement reaching the underlying WordPress MySQL/MariaDB database without prepared statements or proper sanitization via $wpdb->prepare(). Because the CPE (cpe:2.3:a:speakout!:speakout!_email_petitions) covers all versions through 4.6.5 with no lower bound published, the injection point likely exists in a long-standing code path such as a petition signature, list, or admin endpoint that does not require authentication.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory does not list a fixed version above 4.6.5 in the supplied data, so administrators should verify the plugin's WordPress.org page for a release newer than 4.6.5 before upgrading. As an immediate compensating control, deactivate and remove the SpeakOut! Email Petitions plugin entirely (trade-off: petition functionality is lost until a patched version ships), or place the WordPress site behind a Web Application Firewall such as Patchstack, Wordfence, or a cloud WAF with a virtual patch / SQLi ruleset for this CVE (trade-off: false positives on legitimate petition submissions and dependency on signature freshness). Restrict database privileges for the WordPress DB user to deny FILE, CREATE, and DROP where feasible to limit blast radius. Monitor the advisory at https://patchstack.com/database/wordpress/plugin/speakout/vulnerability/wordpress-speakout-email-petitions-plugin-4-6-5-sql-injection-vulnerability for fix release information.