The plugin contains an unauthenticated SQL Injection vulnerability that permits attackers to inject arbitrary SQL statements through unsanitized input, enabling data exfiltration or database tampering. The CVSS score of 9.3 underscores the critical severity of this issue.

WordPress sites that include the SendPress Newsletters plugin version 1.26.1.20 or earlier are affected. The flaw is independent of the user’s authentication state, allowing unauthenticated users to trigger the injection through the plugin’s input paths.

The vulnerability’s CVSS score of 9.3 signals a severe risk, and the absence of authentication requirements further lowers the barrier to exploitation. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation. Although the publicly reachable nature of the plugin suggests a high likelihood of automated scanning, the low EPSS score tempers that expectation. The attack vector is likely HTTP requests to the plugin’s endpoints, based on typical SQL injection patterns; this inference is drawn from the description of the flaw. CISA has not listed the vulnerability in its KEV catalog, but operators should still monitor traffic for signs of SQL injection attempts.