CVE-2023-35040 is a missing authorization flaw in the SendPress Newsletters WordPress plugin, scored 5.3 Medium. The record lists versions through 1.23.11.6 as affected. I could not confirm a fixed version, so check the plugin changelog and update to the latest release.
What's affected
The record says the issue affects SendPress Newsletters from an unspecified first version through 1.23.11.6. The Patchstack entry the record points to could not be fetched here, and its web address mentions version 1.22.3.31, which does not match the record's range. I could not confirm which is right, so I list both and recommend you check.
The record's vector shows a network attack with no login and a low integrity impact, with no effect on confidentiality or availability. No fixed version is named in the record.
How to check if you're exposed
Check the installed plugin version in the WordPress admin under Plugins, or from the command line with WP-CLI:
wp plugin list
wp plugin get sendpress --field=version
If the version is at or below the last affected release in the record, treat the site as exposed until you confirm a fixed release. Also check your update log and any staging or multisite installs, since plugins are often forgotten on secondary sites.
What to do now
- Open the plugin's changelog in the WordPress directory or the vendor's site and find the release that fixes this issue. I could not confirm one, so do not skip this step.
- Update the plugin to the latest release, after a backup and a test on staging.
- If the plugin is unused, deactivate and delete it.
- Review site roles, and remove accounts that do not need to exist.
- Turn on automatic plugin updates where you can accept the risk of unattended changes.
Why it matters
Missing authorization means a function checks who you are, or nothing at all, but not whether you are allowed to do what you ask. In WordPress plugins this often shows up as an action handler that any visitor can call.
The impact is limited here, a low integrity change, which explains the medium score. For a newsletter plugin, though, integrity of subscriber data and mailing settings matters to the site's reputation.
The weakness classes involved are CWE-862 (Missing Authorization). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Source conflict on versions: the record says through 1.23.11.6, while the Patchstack address in the record mentions 1.22.3.31. I could not read the Patchstack page, so verify the range against the plugin changelog.
Quick check
Is there a fixed version?
I could not confirm one from the record or a fetched page. Read the plugin's changelog and install the latest release.
Can an anonymous visitor exploit it?
The record's vector shows no privileges required, so check the Patchstack entry for specifics.
Sources
Last reviewed: 19 October 2026.
