Sendpress Newsletters
Monthly
Unauthenticated SQL injection in the SendPress Newsletters WordPress plugin (all versions up to and including 1.26.1.20) allows a remote attacker who can reach an affected site to inject arbitrary SQL and read data from the site's database - including WordPress user credential hashes, secret keys and plugin/configuration tables - with no login and no user interaction. Our independent assessment recalibrates the reported CVSS 9.3 (vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5): a genuine high-priority issue rather than a CVSS-inflated one, with confidentiality-only impact and unchanged scope. The practical limiting factor is deployment - only sites actively running this plugin at or below the vulnerable version are exposed, and the exact injectable endpoint/parameter is not disclosed - and no public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis.
Unauthenticated remote attackers can read newsletter sending logs - including recipient email addresses - from any WordPress site running the SendPress Newsletters plugin through version 1.26.1.20, because the logging endpoint is gated by a single hardcoded token that is identical across every installation and therefore effectively a public secret. The issue is present in default configurations with no prerequisite beyond the plugin being installed and the endpoint being reachable, and publicly available exploit code exists (documented by WPScan), though there is no confirmation of active exploitation (not in CISA KEV). Impact is limited to confidentiality of log data - no write access, no authentication bypass to broader site functions, and no code execution - with EPSS at 0.14% (3rd percentile), consistent with a genuine but modest-severity information disclosure best triaged as low-to-moderate priority.
Improper access control in the SendPress Newsletters WordPress plugin (through 1.26.1.20) lets any authenticated subscriber-level user synchronise the entire site user base into a mailing list and drive the newsletter send queue, because several newsletter-management actions omit capability checks. It is scored CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the bar is only a low-privilege account - realistic where the site permits self-registration or the attacker otherwise holds a subscriber credential - and publicly available exploit code exists. EPSS is 0.13% (2nd percentile), indicating low observed exploitation likelihood at time of analysis; no CISA KEV entry is associated with this CVE.
Unauthenticated SQL injection in the SendPress Newsletters WordPress plugin (all versions up to and including 1.26.1.20) allows a remote attacker who can reach an affected site to inject arbitrary SQL and read data from the site's database - including WordPress user credential hashes, secret keys and plugin/configuration tables - with no login and no user interaction. Our independent assessment recalibrates the reported CVSS 9.3 (vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5): a genuine high-priority issue rather than a CVSS-inflated one, with confidentiality-only impact and unchanged scope. The practical limiting factor is deployment - only sites actively running this plugin at or below the vulnerable version are exposed, and the exact injectable endpoint/parameter is not disclosed - and no public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis.
Unauthenticated remote attackers can read newsletter sending logs - including recipient email addresses - from any WordPress site running the SendPress Newsletters plugin through version 1.26.1.20, because the logging endpoint is gated by a single hardcoded token that is identical across every installation and therefore effectively a public secret. The issue is present in default configurations with no prerequisite beyond the plugin being installed and the endpoint being reachable, and publicly available exploit code exists (documented by WPScan), though there is no confirmation of active exploitation (not in CISA KEV). Impact is limited to confidentiality of log data - no write access, no authentication bypass to broader site functions, and no code execution - with EPSS at 0.14% (3rd percentile), consistent with a genuine but modest-severity information disclosure best triaged as low-to-moderate priority.
Improper access control in the SendPress Newsletters WordPress plugin (through 1.26.1.20) lets any authenticated subscriber-level user synchronise the entire site user base into a mailing list and drive the newsletter send queue, because several newsletter-management actions omit capability checks. It is scored CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the bar is only a low-privilege account - realistic where the site permits self-registration or the attacker otherwise holds a subscriber credential - and publicly available exploit code exists. EPSS is 0.13% (2nd percentile), indicating low observed exploitation likelihood at time of analysis; no CISA KEV entry is associated with this CVE.