SendPress Newsletters EUVD-2026-95501

Exploitation requires an authenticated account at only subscriber level (CVSS PR:L), so the practical prerequisite is that the target WordPress site permits user registration or the attacker otherwise obtains any low-privilege account; the vulnerable SendPress Newsletters plugin (through 1.26.1.20) must be installed and active. No admin rights, no user interaction, and no non-default plugin configuration are needed - the newsletter-management actions simply omit capability checks. The key limiting factor is the authentication requirement: sites that disable self-registration meaningfully reduce exposure, since an attacker must first acquire a subscriber-level credential.

This is a moderate, authorization-focused flaw (CWE-284 missing capability checks) rather than a high-urgency priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) indicates a network-reachable, low-complexity attack requiring low privileges (PR:L) and no user interaction, with only limited integrity impact and no confidentiality or availability impact per the vendor scoring. Signals are broadly consistent and point LOW: EPSS is 0.13% (2nd percentile), indicating very low probability of exploitation in the wild, and the vulnerability is NOT on the CISA KEV list. The one escalating signal is that publicly available exploit code exists (WPScan), but POC availability is distinct from active exploitation - there is no evidence of in-the-wild use. The main caveat is a conflict between data and impact scope: the description says the flaw lets a subscriber 'synchronise all site users into a mailing list,' which plausibly exposes all registered users' email addresses (a confidentiality impact), yet the input CVSS scores C:N - verify whether user-data exposure should raise the confidentiality metric. Net: a real but low-severity authenticated access-control bug; patch in routine cycles, not an emergency.

A low-complexity WordPress site allows open user registration (default for many membership/comment sites), so an attacker self-registers a subscriber-level account. Using the publicly available WPScan-documented technique, the attacker invokes the newsletter-management actions that lack capability checks to synchronise every registered site user into a mailing list and to drive the send queue, enabling user-data harvesting and unauthorized newsletter sends/spam. A public POC exists, lowering the skill barrier, though exploitation still requires a valid authenticated subscriber account.