Is CVE-2026-92990 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-92990

Description

The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses.