{"id":"CVE-2026-39795","published":"2026-10-06T09:17:52.540","lastModified":"2026-10-06T15:04:25.990","description":"Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sendpress/vulnerability/wordpress-sendpress-newsletters-plugin-1-26-1-20-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw is an unauthenticated SQL Injection vulnerability in SendPress Newsletters versions up to 1.26.1.20, allowing attackers to execute arbitrary SQL commands. This matters because it can lead to data breaches and loss of system integrity.","exploitability":"Exploitation is relatively easy given the unauthenticated nature, requiring only access to the affected endpoint.","blast_radius":"If exploited, this could result in unauthorized data manipulation or theft, impacting user data and system security.","remediation":"Upgrade to SendPress Newsletters 1.26.1.21 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","unauthenticated","web","data-breach"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:44:02.189Z"}}