SendPress Newsletters CVE-2026-92990

No special conditions beyond the plugin being installed - the logging endpoint is protected by a single hardcoded token that is identical on every SendPress Newsletters installation (through 1.26.1.20), so it is effectively a shared/public secret and the endpoint is exploitable against default configurations by any unauthenticated remote attacker. The only meaningful limiting factors are scope and value: exploitation exposes newsletter sending logs and recipient email addresses only (no write access, no RCE, no authentication bypass to broader site functions), and it requires that the vulnerable plugin version be installed and the logging endpoint reachable over the network.

This is a genuine but modest-severity issue best triaged as low-to-moderate priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3, MEDIUM) is internally consistent with the description: a hardcoded, cross-site token means any unauthenticated remote attacker can reach the logging endpoint over the network with low complexity and no user interaction. Impact is confined to confidentiality at a LOW level (C:L, I:N, A:N) - leaked recipient email addresses and sending logs, not code execution or data modification. Signals are aligned rather than conflicting: EPSS is very low (0.14%, 3rd percentile) and the CVE is NOT on CISA KEV, so there is no evidence of widespread or automated exploitation. The one upgrading signal is that WPScan reports publicly available exploit code - meaning the bar to exploit is low even though real-world exploitation is not confirmed. No SSVC decision data was supplied in the input. Net: a real, trivially-exploitable information-disclosure flaw, but low-value (email/PII leakage only) and affecting a niche plugin, so it warrants routine patching rather than emergency response. Note the vendor is listed as 'unknown' in the CPE, so affected-product attribution should be verified.

An unauthenticated attacker who knows the hardcoded token (identical across all SendPress installations and recoverable from the plugin source, which is public) sends a crafted request to the plugin's logging endpoint on any target WordPress site. The endpoint returns newsletter sending logs containing recipient email addresses, giving the attacker a harvested PII/email list. Public exploit code is available via WPScan, lowering the effort required.