Unauthenticated SQL Injection in Newsletter Subscription Form by WordPress
CVE-2026-41555

9.3CRITICAL

Key Information:

Vendor

WordPress
Status
Newsletter Subscription Form – User Subscriptions Form, Capture Email
Vendor
CVE Published:
6 October 2026

What is CVE-2026-41555?

The Newsletter Subscription Form plugin for WordPress contains a vulnerability that allows unauthenticated users to exploit a SQL injection flaw within the user subscriptions form. This security gap exposes the plugin's database to unauthorized database queries, potentially allowing attackers to manipulate the database, retrieve sensitive information, and compromise the integrity of the website. Affected versions prior to 1.5.9 are at risk, making it crucial for administrators to update their plugins to avoid exploitation.

Affected Version(s)

Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9

References

https://patchstack.com/database/wordpress/plugin/newslett...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dzeusking | Patchstack Bug Bounty Program
.