CVE-2026-39795

CriticalCVSS 9.3

Published: 06/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

23th percentile - higher than 23% of all known CVEs

Summary

The SendPress Newsletters WordPress plugin (versions up to 1.26.1.20) contains a blind SQL injection vulnerability due to improper neutralization of special elements in SQL commands.

Risk Assessment

An attacker could exploit this to gain unauthorized access to the database, potentially leading to data leakage or modification.

Recommendation

Update the SendPress Newsletters plugin to the latest version that fixes the vulnerability.

Other vulnerabilities in SendPress Newsletters

CVE-2026-93855High
The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to and including 1.26.1.20 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in brewlabs SendPress Newsletters sendpress allows Blind SQL Injection.This issue affects SendPress Newsletters: from n/a through 1.26.1.20.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS