{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6235", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-04-13T16:12:01.215Z", "datePublished": "2026-04-22T07:45:37.881Z", "dateUpdated": "2026-04-22T07:45:37.881Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-22T07:45:37.881Z"}, "affected": [{"vendor": "sendmachine", "product": "Sendmachine for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.20", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the plugin's SMTP configuration, which can be leveraged to intercept all outbound emails from the site (including password reset emails)."}], "title": "Sendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7889e071-84a8-46ec-abe5-5c98980ce275?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sendmachine/tags/1.0.20/sendmachine_wp_admin.php#L183"}, {"url": "https://plugins.trac.wordpress.org/browser/sendmachine/tags/1.0.20/sendmachine_wp_admin.php#L174"}, {"url": "https://plugins.trac.wordpress.org/browser/sendmachine/tags/1.0.20/includes/sendmachine_email_manager.php#L39"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2026-03-10T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-04-21T19:01:50.000Z", "lang": "en", "value": "Disclosed"}]}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the plugin's SMTP configuration, which can be leveraged to intercept all outbound emails from the site (including password reset emails)."}], "id": "CVE-2026-6235", "lastModified": "2026-04-22T09:16:26.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Primary"}]}, "published": "2026-04-22T09:16:26.263", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/sendmachine/tags/1.0.20/includes/sendmachine_email_manager.php#L39"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/sendmachine/tags/1.0.20/sendmachine_wp_admin.php#L174"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/sendmachine/tags/1.0.20/sendmachine_wp_admin.php#L183"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7889e071-84a8-46ec-abe5-5c98980ce275?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T09:37:46.242693+00:00", "value": {"mitigation_remediation": ["Update the Sendmachine plugin to the latest available version, which removes the authorization bypass in manage_admin_requests.", "If an update is not yet released, temporarily deactivate the Sendmachine plugin to prevent unauthorized SMTP configuration changes.", "Restrict access to the WordPress administrative dashboard to trusted IP addresses and enforce two\u2011factor authentication for administrators to mitigate potential future abuse."], "summary": {"action": "Immediate Patch", "impact": "Authorization bypass allowing SMTP hijack and email interception"}, "threat_synthesis": {"affected_systems": "Sendmachine for WordPress plugin, any installed version up to and including 1.0.20.", "description_and_impact": "The Sendmachine for WordPress plugin suffers from a missing authorization check in the manage_admin_requests function. An attacker who can reach the plugin\u2019s admin endpoint without authentication can overwrite the SMTP settings. This capability enables the attacker to intercept all outgoing emails, including password reset mails, effectively allowing credential theft and facilitating further phishing or social engineering campaigns.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 9.8, indicating critical severity. Exploitation requires no authentication and can be performed from any network scope that can reach the WordPress admin interface. While an EPSS score is not available, the absence of a KEV listing does not diminish the seriousness of the flaw. Given the high impact and straightforward attack vector, the risk of exploitation is considered significant, especially on publicly exposed sites."}}}}, "created": "2026-04-22T09:45:13.083310+00:00", "updated": "2026-04-22T09:45:13.083320+00:00", "vendors": []}