CVE-2026-59537 Sender CVE debrief

Who should care

Users of Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce versions <= 2.10.22, particularly administrators, should prioritize patching this HIGH severity vulnerability to prevent potential SQL Injection attacks. Security teams and vulnerability management teams should also review the affected scope and severity to ensure proper mitigation.

Technical summary

CVE-2026-59537 is an Administrator SQL Injection vulnerability in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce. The vulnerability has a CVSS score of 7.6 and a CVSS severity of HIGH. The vulnerability was reported by [email protected] and is categorized under CWE-89. This SQL Injection vulnerability can be exploited by administrators with access to the affected system.

Defensive priority

Patching this HIGH severity SQL Injection vulnerability is a top priority for administrators of affected Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce instances. Security teams should review compensating controls and monitor for potential SQL Injection attacks while remediation is scheduled and verified.

Recommended defensive actions

• Patch Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce to version > 2.10.22
• Inventory and verify instances of Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
• Monitor for potential SQL Injection attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-27T15:17:04.333Z and has not been modified since then. The NVD entry is currently Deferred. The vulnerability was reported by [email protected] and is categorized under CWE-89. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability.

Official resources