CVE-2026-92989

MediumCVSS 4.3

Published: 09/10/2026(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check user capabilities on several newsletter-management actions. Any authenticated subscriber-level user can synchronize all site users into a mailing list and drive the newsletter send queue.

Risk Assessment

A low-privileged user can mass-synchronize users and manipulate newsletter sending, potentially leading to unauthorized content distribution and privacy violations.

Recommendation

Update the SendPress Newsletters plugin to a version newer than 1.26.1.20 if available. Until then, restrict user registration or disable the plugin.

Other vulnerabilities in SendPress Newsletters WordPress plugin

CVE-2026-92990Medium
The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is identical on every site instead of a per-site secret. This allows unauthenticated users to read newsletter sending logs, including recipient email addresses.

Original NVD description (English source)

The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS