Get real-time updates on Telegram
Verified
CVE-2026-92989: SendPress Newsletters 0 through 1.26.1.20
Affected technology
SendPress Newsletters · 0 through 1.26.1.20
Vendor not specified by the source
Description’s affected range: through 1.26.1.20 does not check the user's capability on several newsletter-management actions
Component: Not specified by the source
What an attacker can do
Any authenticated subscriber-level user can synchronise all site users into a mailing list and to drive the newsletter send queue.
- KEV
- no
Provenance
- GitHub Advisory Database · Source record · observed 2026-10-09 12:23:46.868896+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-09 12:21:30.679837+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-92989.html