medium5.3
CVE-2026-92990
The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a pe…
Impact
The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses.
Affected products
| Product | Affected versions |
|---|---|
| SendPress Newsletters WordPress Plugin | through 1.26.1.20 |
Versions were read from the advisory text. No structured product data has been published for this record yet.