medium4.3
CVE-2026-92989
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authen…
Impact
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.
Affected products
| Product | Affected versions |
|---|---|
| SendPress Newsletters WordPress Plugin | through 1.26.1.20 |
Versions were read from the advisory text. No structured product data has been published for this record yet.