CVE-2026-39795
9.3 CRITICALPublished 2026-10-06 · Updated 2026-10-06
AI risk analysis
- Summary
- The flaw is an unauthenticated SQL Injection vulnerability in SendPress Newsletters versions up to 1.26.1.20, allowing attackers to execute arbitrary SQL commands. This matters because it can lead to data breaches and loss of system integrity.
- Exploitability
- Exploitation is relatively easy given the unauthenticated nature, requiring only access to the affected endpoint.
- Blast radius
- If exploited, this could result in unauthorized data manipulation or theft, impacting user data and system security.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to SendPress Newsletters 1.26.1.21 or later.
sql-injectionunauthenticatedwebdata-breach
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Weaknesses
CWE-89
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2015-20122
- CRITICALCVE-2023-54400PoC
- CRITICALCVE-2026-39764
- CRITICALCVE-2026-39785
- CRITICALCVE-2026-55680PoC
- CRITICALCVE-2026-55683PoC
- CRITICALCVE-2026-55684PoC
- CRITICALCVE-2026-72507PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.