CVE Intelligence
Analysis AI-assisted

CVE-2026-6235: Sendmachine for WordPress - Missing Authorization in manage_admin_requests (up to 1.0.20)

The Sendmachine for WordPress plugin, in all versions up to and including 1.0.20, does not properly verify user authorization in its manage_admin_requests function, classified as CWE-862. According to the record, an unauthenticated attacker could overwrite the plugin's SMTP configuration and intercept outbound site email, including password reset messages. The CVSS 3.1 base score is 9.8 (critical), and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The Sendmachine for WordPress plugin contains a missing authorization issue (CWE-862) in its manage_admin_requests function, affecting all versions up to and including 1.0.20. As described in the Wordfence entry, the plugin does not properly verify that a user is authorized to perform an action.

Impact

  • According to the record, an unauthenticated attacker may be able to overwrite the plugin's SMTP configuration.
  • A changed SMTP configuration could allow interception of outbound site email, including password reset emails.
  • The CVSS 3.1 vector rates confidentiality, integrity and availability impact as high, with a base score of 9.8 (critical), as listed in the NVD record.

Affected products and versions

  • Sendmachine Sendmachine for WordPress, versions up to and including 1.0.20.
  • The record lists no fixed version. This is an unknown status, not evidence that no fix exists.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00673 (percentile 0.50811), and SSVC lists exploitation as none and automatable as yes.

Remediation and mitigation

  • Confirm whether the Sendmachine plugin is installed and which version is active.
  • Update to a release that the plugin vendor has confirmed as fixed. The record does not identify one, so check the Wordfence entry and the vendor for current guidance.
  • If the plugin is not required, deactivate and remove it.
  • Review the current SMTP settings and outbound mail routing, and verify that they match what administrators intended.

Detection guidance

  • Review recent changes to plugin options related to mail delivery.
  • Watch for unexpected changes in outbound email routing or unexpected handling of password reset messages.
  • Review web and application logs for unusual activity affecting the plugin's administrative functions.

Limitations of the available information

  • The record does not identify a fixed version, patch release or vendor remediation statement.
  • The record does not describe the exact requests or conditions that trigger the issue, and this analysis does not provide them.
  • The record's source status is Deferred, so the information may change.

Frequently asked questions

Which versions of Sendmachine for WordPress are affected?

The record lists all versions up to and including 1.0.20 as affected. It does not list a fixed version.

Is this vulnerability being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.