CVE-2026-39530: WordPress SpeakOut! Email Petitions plugin <= 4.6.5 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the SpeakOut! Email Petitions WordPress plugin at version 4.6.5 and below. The flaw is reachable over the network with no authentication or user interaction required, meaning any remote attacker can send a crafted HTTP request to the affected endpoint. Successful exploitation gives the attacker read access to the underlying database and limited ability to disrupt service availability. No fix has been published yet; HarborGuard tracks this advisory and will make a patched rebuild available as soon as upstream releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress installation over the network; the vulnerable endpoint is exposed to any HTTP client that can connect to the web server.

• AuthenticationNot required

  No account or session token is needed; the injection can be triggered by an anonymous request.

• Victim interactionNot required

  No user action is required; the attacker sends a direct request to the affected endpoint without involving any site visitor.

• Attack complexityDetail

  Exploit reliability is high and no special conditions are required; a crafted SQL payload can be delivered in a straightforward, repeatable request.

Blast Radius

• Reads arbitrary database rows, including user email addresses, hashed passwords, petition signatures, and any other data stored in the WordPress database.
• Scope extends beyond the plugin itself: the CVSS Scope token is Changed, so data from other components sharing the same database (other plugins, the WordPress core tables) is also readable.
• Causes limited disruption to service availability, consistent with an attacker issuing resource-intensive queries that degrade database response times.