CVE Intelligence
Analysis AI-assisted

CVE-2026-41555: WordPress Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin up to 1.5.9 – SQL Injection

Patchstack reports an unauthenticated SQL injection in the Newsletter Subscription Form – User Subscriptions Form, Capture Email WordPress plugin for versions up to and including 1.5.9, scored 9.3 (critical). The record lists no fixed version, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-41555 is a SQL injection flaw (CWE-89) in the Newsletter Subscription Form – User Subscriptions Form, Capture Email plugin for WordPress, affecting versions up to and including 1.5.9. According to the record, the flaw can be reached without authentication.

Impact

  • The Patchstack score is 9.3 (critical). The vector indicates network reachability, low complexity, no privileges and no user interaction.
  • The vector reports high confidentiality impact, no integrity impact and low availability impact, with a changed scope.
  • SQL injection can allow an attacker to read data the plugin can access in the database. The sources do not detail which data is exposed.

Affected products and versions

  • Product: Weblizar - WordPress Themes & Plugin Newsletter Subscription Form – User Subscriptions Form, Capture Email.
  • Affected range: up to and including 1.5.9.
  • Fixed version: none listed in the record consulted.

Exploitation status

  • The CVE is not listed in CISA KEV in the record.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • SSVC marks exploitation as none and automatable as yes. The EPSS probability is 0.00247 with a percentile of 0.15094 as of 2026-10-23.

Remediation and mitigation

  • Identify all sites running the plugin and verify the installed version.
  • Monitor the vendor and Patchstack entries for a fixed release, and update once a fix is published and verified.
  • Until a fix is confirmed, consider disabling the subscription form if it is not essential, and limit database account privileges to the minimum needed.
  • Keep WordPress core and other plugins current and maintain tested backups.

Detection guidance

  • Review web server and application logs for unusual volumes or malformed requests directed at the subscription form.
  • Watch for database errors or unexpected query behavior associated with the plugin.
  • Check for unexpected changes in subscriber lists or newly created administrative accounts.

Limitations of the available information

  • The record contains no fixed version, no vendor advisory text beyond the description, and no technical reproduction details. This analysis does not add them.
  • The sources do not specify which database tables or fields are reachable.
  • The record status is Deferred, and EPSS and SSVC values may change over time.

Frequently asked questions

Is this vulnerability being actively exploited?

Not according to the record. CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record lists the plugin up to and including 1.5.9. No fixed version is listed in the record.

What should site owners do now?

Check whether the plugin is installed, watch for a vendor or Patchstack fix, consider disabling the subscription form if it is not essential, and keep tested backups.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.