CVE-2026-39795: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in brewlabs SendPress Newsletters

CVE-2026-39795 is an SQL Injection vulnerability classified under CWE-89 in the SendPress Newsletters plugin by brewlabs. It affects all versions up to and including 1.26.1.20 and allows unauthenticated attackers to inject malicious SQL commands. The vulnerability has a CVSS 3.1 base score of 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact reported. There is no vendor advisory or patch information available at this time.

The vulnerability allows unauthenticated remote attackers to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity of data is not impacted according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting access to the affected plugin or disabling it if possible to mitigate risk.