SQL Injection Vulnerability in SendPress Newsletters Plugin for WordPress

CVE-2026-93855

What is CVE-2026-93855?

The SendPress Newsletters plugin for WordPress is susceptible to a time-based SQL injection through the 'subscriberid' parameter, affecting all versions up to 1.26.1.20. This vulnerability arises from improper escaping of user-supplied input and inadequate preparation of the SQL query. As a result, an unauthenticated attacker can inject additional SQL statements into existing queries, potentially leading to unauthorized access to sensitive database information. The handler is secured by a nonce tied to a hardcoded action value that is publicly accessible, allowing attackers to bypass nonce protections and exploit this security flaw.

References