CVE-2026-93855: SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameter
The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'subscriberid' parameter in all versions up to, and including, 1.26.1.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The nonce gating the handler uses the hardcoded action value 'sendpress-is-awesome', which is rendered on the same public page served by the [sp-form formid="manage"] shortcode, making it trivially obtainable by unauthenticated visitors and effectively bypassing the nonce as an access control.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated remote attackers can exploit it. They do not need WordPress credentials because the required nonce is publicly obtainable from a page that renders the [sp-form formid="manage"] shortcode.
Which installations are affected?
SendPress Newsletters versions up to and including 1.26.1.20 are affected. Exploitation depends on the public availability of a page using the [sp-form formid="manage"] shortcode, where the handler nonce is rendered.
What could an attacker obtain?
The SQL injection can be used to extract sensitive information from the WordPress database. The issue is described as time-based SQL injection through the subscriberid parameter.
How can I determine whether my site is exposed?
Check whether SendPress Newsletters is installed at version 1.26.1.20 or earlier, and whether any publicly accessible page includes the [sp-form formid="manage"] shortcode. Such a page exposes the hardcoded-action nonce needed by the affected handler.