PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39795 brewlabs CVE debrief

A critical SQL injection vulnerability exists in the SendPress Newsletters plugin, affecting versions from n/a through 1.26.1.20. This issue allows for Blind SQL Injection, posing a significant risk to affected systems. The vulnerability has a CVSS score of 9.3 and a severity rating of CRITICAL. Defenders and administrators responsible for systems using the SendPress Newsletters plugin should assess exposure and prioritize remediation to prevent potential Blind SQL Injection attacks and unauthorized database queries.

Vendor
brewlabs
Product
SendPress Newsletters
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-06
Original CVE updated
2026-10-28
Advisory published
2026-10-06
Advisory updated
2026-10-28

Who should care

Defenders and administrators responsible for systems using the SendPress Newsletters plugin should assess exposure and prioritize remediation.

Why it matters

CVE-2026-39795 is a critical SQL injection vulnerability in the SendPress Newsletters plugin, affecting versions from n/a through 1.26.1.20. Defenders and administrators should assess exposure, verify inventory, and prioritize remediation to prevent potential Blind SQL Injection attacks and unauthorized database queries.

  • Potential for unauthorized database queries and data exposure.
  • Risk of Blind SQL Injection attacks targeting affected plugin versions.
  • Need for immediate assessment and remediation to prevent exploitation.
  • Verification of inventory and application of patches or remediation is required.

Technical summary

The SendPress Newsletters plugin is vulnerable to Blind SQL Injection, with a CVSS score of 9.3 and a severity rating of CRITICAL. The vulnerability affects versions from n/a through 1.26.1.20. This issue allows for Blind SQL Injection, posing a significant risk to affected systems. The CVE record and NVD entry provide details on the SQL injection vulnerability in SendPress Newsletters.

Defensive priority

Immediate assessment and remediation are required for systems using the affected SendPress Newsletters plugin versions.

Recommended defensive actions

  • Assess exposure by identifying systems using the affected SendPress Newsletters plugin versions.
  • Verify inventory for SendPress Newsletters plugin versions from n/a through 1.26.1.20.
  • Apply vendor-provided remediation or patches for the SendPress Newsletters plugin.
  • Monitor for potential SQL injection attempts targeting the affected plugin.

Evidence notes

The CVE record and NVD entry provide details on the SQL injection vulnerability in SendPress Newsletters. However, specific details about exploitation or victim impact are not provided.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-39795 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-39795

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-39795 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-39795

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.