CVE-2026-92990

MediumCVSS 5.3

Published: 09/10/2026(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

3th percentile - higher than 3% of all known CVEs

Summary

The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is identical on every site instead of a per-site secret. This allows unauthenticated users to read newsletter sending logs, including recipient email addresses.

Risk Assessment

Exposure of recipient email addresses may violate privacy and data protection regulations (e.g., GDPR) and facilitate phishing attacks.

Recommendation

Update the SendPress Newsletters plugin to a version newer than 1.26.1.20 if available. Until then, consider disabling the plugin or restricting access to the logging endpoint.

Other vulnerabilities in SendPress Newsletters WordPress plugin

CVE-2026-92989Medium
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check user capabilities on several newsletter-management actions. Any authenticated subscriber-level user can synchronize all site users into a mailing list and drive the newsletter send queue.

Original NVD description (English source)

The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS