CVE-2026-92989 - Vulnerability Details - OpenCVE

The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Wordpress-extensions	Sendpress Newsletters

No data.

No data.

References

Link	Providers
https://wpscan.com/vulnerability/771aeab9-2bd2-4d77-b3b8-9fdfb651507f/

History

Wed, 21 Oct 2026 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Wordpress-extensions Wordpress-extensions sendpress Newsletters
Vendors & Products		Wordpress-extensions Wordpress-extensions sendpress Newsletters

Fri, 09 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 09 Oct 2026 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284

Fri, 09 Oct 2026 06:45:00 +0000

Type	Values Removed	Values Added
Description		The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.
Title		SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing
References		https://wpscan.com/vulnerability/771aeab9-2bd2-4d77-b3b8-9fdfb651507f/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2026-10-09T06:00:07.346Z

Updated: 2026-10-09T14:50:09.575Z

Reserved: 2026-09-17T14:00:50.528Z

Link: CVE-2026-92989

Vulnrichment

Updated: 2026-10-09T14:46:36.922Z

NVD

Status : Deferred

Published: 2026-10-09T07:17:19.050

Modified: 2026-10-09T15:17:19.783

Link: CVE-2026-92989

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92989", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-09-17T14:00:50.528Z", "datePublished": "2026-10-09T06:00:07.346Z", "dateUpdated": "2026-10-09T14:50:09.575Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-10-09T06:00:07.346Z"}, "title": "SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing", "problemTypes": [{"descriptions": [{"description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "SendPress Newsletters", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "1.26.1.20"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue."}], "references": [{"url": "https://wpscan.com/vulnerability/771aeab9-2bd2-4d77-b3b8-9fdfb651507f/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Enrico Marcolini - Claudio Marchesini - Dottor Marc", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-92989", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-09T14:47:41.402480Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T14:50:09.575Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-92989", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-09T14:47:41.402480Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-09T14:46:36.922Z"}}], "cna": {"title": "SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Enrico Marcolini - Claudio Marchesini - Dottor Marc"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "SendPress Newsletters", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.26.1.20"}], "defaultStatus": "unknown"}], "references": [{"url": "https://wpscan.com/vulnerability/771aeab9-2bd2-4d77-b3b8-9fdfb651507f/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-10-09T06:00:07.346Z"}}}, "cveMetadata": {"cveId": "CVE-2026-92989", "state": "PUBLISHED", "dateUpdated": "2026-10-09T14:50:09.575Z", "dateReserved": "2026-09-17T14:00:50.528Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2026-10-09T06:00:07.346Z", "assignerShortName": "WPScan"}, "dataVersion": "5.2"}