Is CVE-2026-92989 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-92989

Description

The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue.