[ CVE-2026-92989 · Published 9 Oct 2026 ]
Vulnerability in Unknown SendPress Newsletters
CVSS 4.3
EPSS <1%No fix listed yet
[ Description ]Official description
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.