CVE-2026-93855

{
  "etk_id": "ETK-2026-2936",
  "cve_id": "CVE-2026-93855",
  "display_id": "CVE-2026-93855",
  "ghsa_id": "GHSA-j32g-r42g-5gh6",
  "euvd_id": "EUVD-2026-112587",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated SQL injection in SendPress Newsletters",
  "summary": "SendPress Newsletters for WordPress is affected by an SQL injection issue in versions through 1.26.1.20. An unauthenticated remote attacker may be able to access sensitive database information when the public subscriber-management form is exposed.",
  "mitigation": "Disable the plugin or remove public access to its subscriber-management form until a patched release is available. Monitor for and install the vendor's update when a fixed version is published.",
  "vendor": "brewlabs",
  "product": "SendPress Newsletters",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.26.1.20"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "SendPress Newsletters",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 18.7946546,
  "t0_at": "2026-10-29T03:39:14.346000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-29T03:39:14.346000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-29T03:39:14.346000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93855"
    }
  }
}