CVE-2026-41555: WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability

Q: Who can exploit this issue?

The issue is unauthenticated, so an attacker does not need a WordPress account or prior privileges to attempt exploitation. Network access to the affected site is indicated by the CVSS attack vector.

Q: What is the likely impact of successful exploitation?

The CVSS vector indicates high confidentiality impact and low availability impact, with no integrity impact listed. The vulnerability type is SQL injection.

Published Oct 6, 2026

Updated

Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptions Form, Capture Email <= 1.5.9 versions.

Affected Software

1 affected component

Newsletter Subscription Form – User Subscriptions Form, Capture Email<=1.5.9

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The issue is unauthenticated, so an attacker does not need a WordPress account or prior privileges to attempt exploitation. Network access to the affected site is indicated by the CVSS attack vector.

Which plugin versions are affected?

Newsletter Subscription Form – User Subscriptions Form, Capture Email versions 1.5.9 and earlier are identified as affected.

What is the likely impact of successful exploitation?

The CVSS vector indicates high confidentiality impact and low availability impact, with no integrity impact listed. The vulnerability type is SQL injection.

CVE-2026-41555: WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin <= 1.5.9 - SQL Injection vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Which plugin versions are affected?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which plugin versions are affected?

What is the likely impact of successful exploitation?