CVE-2026-92989CWE-284broken-access-control

CVE-2026-92989

Medium · published October 9, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
4.0
In the wild
Unconfirmed
What it is

The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00152 · 4.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-10-09T11:17Z
References (1)
https://wpscan.com/vulnerability/771aeab9-2bd2-4d77-b3b8-9fdfb651507f/ · [email protected]
EPSS history
Timeline
  • 10 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 09 OCT 06:00Z
    SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing
    cvelistv5
  • 09 OCT 06:00Z
    SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing
    cvelistv5