EUVD-2026-93039
GHSA-5339-cxjh-26j4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running SendPress plugin
-
ExploitSend crafted request with SQL payload
-
ExecutionInjection executed against WordPress DB
-
ImpactExfiltrate user and credential data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the SendPress Newsletters plugin (version <= 1.26.1.20) installed and active on a reachable WordPress site - exploitation is remote and unauthenticated (AV:N/PR:N/UI:N) against affected installations. The primary limiting factor is deployment: the vulnerability only affects sites running this specific plugin at or below the vulnerable version, and the exact injectable endpoint/parameter is not disclosed in the provided data, so attackers must know or discover the vulnerable request. No user interaction, authentication, or non-default configuration is required according to the CVSS vector. |
| Impact | This is a genuine high-priority issue, not a CVSS-inflated one. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity, network-reachable SQL injection (CWE-89) - the most readily exploitable class of web vulnerability - and the 9.3 base score is driven largely by the Scope:Changed flag combined with C:H. Signals are mixed in completeness: no EPSS score, no CISA KEV listing, and no explicit POC indicator were supplied, so there is no confirmation of active exploitation or published exploit code at this time. However, Patchstack-reported WordPress plugin SQLi flaws are frequently reverse-engineered from the patch diff within days, so the practical exploitation window is short even without a current POC. One internal inconsistency worth noting: the vendor-supplied vector sets I:N and A:L despite classifying this as SQL injection, which typically permits at least read access to the full database (C:H is consistent) and sometimes write access - treat the integrity rating as possibly understated and verify against the actual injectable sink. Net: prioritize patching, but real-world urgency is tempered by the plugin's modest deployment footprint rather than by any mitigating technical factor. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted HTTP request to a public endpoint of a WordPress site running SendPress Newsletters <= 1.26.1.20, injecting malicious SQL through an unsanitized parameter. The payload is executed against the WordPress database, allowing extraction of sensitive data such as user records, password hashes, and session/secret material. No public exploit was identified at time of analysis, but the low attack complexity and lack of authentication make weaponization straightforward once the vulnerable parameter is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated SQL injection in the SendPress Newsletters WordPress plugin (all versions up to and including 1.26.1.20) allows a remote attacker who can reach an affected site to inject arbitrary SQL and read data from the site's database - including WordPress user credential hashes, secret keys and plugin/configuration tables - with no login and no user interaction. Our independent assessment recalibrates the reported CVSS 9.3 (vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5): a genuine high-priority issue rather than a CVSS-inflated one, with confidentiality-only impact and unchanged scope. The practical limiting factor is deployment - only sites actively running this plugin at or below the vulnerable version are exposed, and the exact injectable endpoint/parameter is not disclosed - and no public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis.
RemediationAI
No vendor-released patch version is identified in the available data - the only reference is Patchstack's vulnerability record at https://patchstack.com/database/wordpress/plugin/sendpress/vulnerability/wordpress-sendpress-newsletters-plugin-1-26-1-20-sql-injection-vulnerability?_s_id=cve, which should be checked for a fixed release. Because exploitation is unauthenticated and remote, the most effective immediate control is to deactivate and uninstall the SendPress Newsletters plugin while no fix is confirmed; the trade-off is loss of newsletter subscription and mailing functionality, so this is the right call only where that feature is non-essential. If the plugin must stay live, apply virtual patching at the edge: a WAF/IDS rule set that blocks SQL metacharacters and UNION/SLEEP/benchmark-style payloads on the plugin's endpoints and on admin-ajax.php/REST requests carrying the plugin's action parameters will stop most automated exploitation but can be bypassed by encoding tricks and may generate false positives for legitimate form submissions. Additionally, restrict access to plugin-specific request paths by IP allowlist where the newsletter admin UI is used only from known offices, and rate-limit or CAPTCHA-challenge unauthenticated POSTs to the plugin's handlers, accepting that these raise friction for genuine subscribers. Assume read compromise of the database and, as incident response, rotate the WordPress database password, regenerate wp-config salts, force-reset administrator credentials, and review wp_users role changes for unauthorized escalation; simply keeping the plugin updated once a patched release above 1.26.1.20 ships remains the durable fix, with no patch currently confirmed in the provided data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), i.e. classic SQL injection in a PHP WordPress plugin. SendPress Newsletters is a WordPress newsletter/email-marketing plugin by Brewlabs (CPE cpe:2.3:a:brewlabs:sendpress_newsletters:*:*:*:*:*:*:*:*, whose wildcard version field records all versions as in-range while the advisory caps the affected set at 1.26.1.20). Because the CVSS vector carries PR:N and UI:N, the injectable code path is reachable before any authentication or capability check - typically a front-end handler, admin-ajax.php action, or REST route that passes user-supplied input into a query built with $wpdb without parameterization (prepare()/placeholders) or strict casting. Our assessment keeps the attack vector, complexity, privileges and user interaction at AV:N/AC:L/PR:N/UI:N but scores impact as C:H/I:N/A:N with S:U, differing from the reporter's S:C/I:N/A:L: the evidence supports read-only disclosure of database contents rather than cross-boundary integrity loss or availability impact. Read access to wp_users password hashes, wp_usermeta capabilities and wp-config-derived secrets is the realistic worst case, and while exfiltrated hashes can be cracked or replayed offline to escalate to administrator, that is a downstream consequence of the confidentiality breach, not an in-band write primitive.
Know when Sendpress Newsletters gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) yielding full database read (C:H); scope kept Unchanged and I/A set N absent evidence of write or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.
Executive ViewAI
WordPress sites running the SendPress Newsletters plugin at versions up to and including 1.26.1.20 are exposed to an unauthenticated SQL injection that could allow an attacker to read sensitive database contents such as user credential hashes, secret keys, and configuration data. Leadership should care because this is a confidentiality-focused, high-severity issue with no vendor-released patch identified at time of analysis, and exposure is limited to sites that actively run the vulnerable plugin. No public exploit code or confirmed active exploitation (CISA KEV) has been identified, so immediate action should focus on inventory, virtual patching or plugin removal, and secret rotation.
No vendor-released patch identified at time of analysis. Interim mitigations include deactivating or removing the SendPress Newsletters plugin, applying WAF/virtual patching to block SQL injection attempts, restricting public access to vulnerable endpoints where feasible, rotating WordPress credentials and salts, and monitoring logs for unauthorized database access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Sendpress Newsletters
View allUnauthenticated remote attackers can read newsletter sending logs - including recipient email addresses - from any WordP
Improper access control in the SendPress Newsletters WordPress plugin (through 1.26.1.20) lets any authenticated subscri
Exploit-DB