5.3
Medium
CVE-2026-92990 The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that…
Description
The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| SendPress Newsletters 1.26 | earliest → 1.26.1.20 | No fix stated |
Other CVEs of SendPress Newsletters
The 4 CVEs of SendPress Newsletters →
CVE-2026-92989
The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several…
4.3
Medium
CVE-2024-1588
The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which…
6.8
Medium
CVE-2024-1589
The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which…
6.1
Medium