CVE-2026-39530

Vulnerability

An unauthenticated SQL injection vulnerability exists in the SpeakOut! Email Petitions plugin for WordPress, affecting versions 4.6.5 and earlier [1]. The vulnerability is triggered via crafted HTTP requests to vulnerable endpoints without requiring authentication.

Exploitation

An attacker can exploit this vulnerability by sending specially crafted SQL injection payloads in HTTP requests to the plugin's vulnerable parameters. No authentication or user interaction is required, and the attack can be performed remotely over the network [1].

Impact

Successful exploitation allows an attacker to directly interact with the database, including reading, modifying, or deleting data. This can lead to information disclosure, data corruption, or privilege escalation depending on the database user permissions [1].

Mitigation

Update the SpeakOut! Email Petitions plugin to version 4.6.5.1 or later, which contains the fix [1]. Alternatively, apply a mitigation rule from Patchstack to block attacks until an update can be applied [1]. If unable to update, contact your hosting provider or web developer for assistance.