Authorization Bypass Vulnerability in Sendmachine for WordPress Plugin

CVE-2026-6235

What is CVE-2026-6235?

The Sendmachine for WordPress plugin is susceptible to an authorization bypass vulnerability due to inadequate verification of user permissions in the 'manage_admin_requests' function. This flaw affects all versions up to and including 1.0.20. As a consequence, unauthorized individuals can gain access to the plugin's SMTP configuration settings, allowing them to manipulate email transmissions from the site. This can facilitate the interception of sensitive communications, including password reset emails, posing a significant risk to users and the site's security.

References