The SendPress Newsletters plugin fails to verify user capabilities for several management actions, enabling any authenticated user with subscriber privileges to synchronise all site users into a mailing list and to trigger the newsletter send queue. This flaw permits an attacker who can log in as a subscriber to inject arbitrary users into a mailing list and cause the plugin to dispatch newsletters to those addresses, potentially resulting in spam, phishing, or data exfiltration. The weakness stems from improper access control.

WordPress sites using the SendPress Newsletters plugin version 1.26.1.20 or earlier. No specific vendor product names beyond the plugin are identified.

As of the latest assessment, the plugin flaw is exploitable by any authenticated subscriber on a WordPress site running SendPress Newsletters 1.26.1.20 or earlier. The attacker can trigger a sync of all site users into a mailing list and subsequently queue newsletters for delivery, effectively using the site as an email relay for spam or phishing. The CVSS score of 4.3 categorizes the vulnerability as low severity, and the EPSS score of less than 1% reflects a very low but non‑zero exploit probability. The issue is not listed in CISA’s KEV catalog. The absence of capability checks suggests that once a site is vulnerable, abuse is straightforward and does not require additional exploitation stages.