CVE-2026-93855
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to and including 1.26.1.20 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.
Risk Assessment
An attacker can read sensitive data from the database, including subscriber data. The nonce gating the handler uses a hardcoded action value rendered on the public page, effectively bypassing the access control.
Recommendation
Update the plugin to a version newer than 1.26.1.20 if available, or disable the [sp-form formid="manage"] shortcode until the fix is applied. Deploy WAF rules blocking suspicious requests.
Other vulnerabilities in SendPress Newsletters
Original NVD description (English source)
The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce gating the handler uses the hardcoded action value 'sendpress-is-awesome', which is rendered on the same public page served by the [sp-form formid="manage"] shortcode, making it trivially obtainable by unauthenticated visitors and effectively bypassing the nonce as an access control.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS