A hardcoded token protected the SendPress Newsletters logging endpoint rather than a dynamic per-site secret, which allows any unauthenticated user to access logs that contain recipient email addresses. The vulnerability does not provide code execution or denial of service; its primary impact is the confidentiality breach of user contact information.

WordPress sites running the SendPress Newsletters plugin version 1.26.1.20 or earlier. The plugin vendor is SendPress.

EPSS score indicates a very low exploitation probability (<1%) and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 5.3 reflects moderate severity. Attacking requires only a simple HTTP request to the protected log endpoint with the hardcoded token, and authentication is not needed. The risk is moderate to high depending on the value of the exposed email list, as the breach could facilitate phishing or spam campaigns. An attacker can exploit the issue by browsing to the log URL with the default token and retrieving the data.