CVE-2026-6235: WordPress Sendmachine Auth Bypass Flaw

CVE-2026-6235 Overview

The Sendmachine for WordPress plugin for WordPress contains a critical authorization bypass vulnerability in the manage_admin_requests function affecting all versions up to and including 1.0.20. This vulnerability stems from the plugin's failure to properly verify that a user is authorized to perform administrative actions. Unauthenticated attackers can exploit this flaw to overwrite the plugin's SMTP configuration, enabling them to intercept all outbound emails from the affected site, including sensitive password reset emails.

Critical Impact

Unauthenticated attackers can hijack email delivery by modifying SMTP settings, potentially intercepting password reset emails and gaining unauthorized access to user accounts across the entire WordPress site.

Affected Products

• Sendmachine for WordPress plugin versions ≤ 1.0.20
• WordPress sites using the vulnerable Sendmachine plugin
• Any WordPress installation with the Sendmachine email manager functionality enabled

Discovery Timeline

• April 22, 2026 - CVE-2026-6235 published to NVD
• April 22, 2026 - Last updated in NVD database

Technical Details for CVE-2026-6235

Vulnerability Analysis

This authorization bypass vulnerability (CWE-862: Missing Authorization) allows unauthenticated remote attackers to modify critical email configuration settings without proper access controls. The vulnerability exists because the manage_admin_requests function fails to implement proper capability checks or nonce verification before processing administrative requests.

The attack can be executed remotely over the network without requiring any user interaction or prior authentication. Once exploited, an attacker gains the ability to redirect all outgoing emails through a malicious SMTP server under their control. This includes password reset emails, user registration confirmations, contact form submissions, and any other email communications generated by the WordPress site.

Root Cause

The root cause is the absence of proper authorization checks in the manage_admin_requests function located in the plugin's administrative code. The vulnerable code paths can be found in sendmachine_wp_admin.php and sendmachine_email_manager.php. The plugin does not verify whether the requesting user has appropriate WordPress capabilities (such as manage_options) before allowing modifications to SMTP configuration settings.

Attack Vector

The attack vector is network-based, requiring no authentication, user interaction, or special privileges. An attacker can craft HTTP requests directly to the vulnerable endpoint to overwrite the SMTP configuration. By redirecting email delivery to an attacker-controlled mail server, all outgoing emails can be intercepted.

The attack flow typically involves:

1. Identifying a WordPress site running the vulnerable Sendmachine plugin
2. Sending a crafted request to the manage_admin_requests function endpoint
3. Overwriting the SMTP server, port, username, and password settings
4. Intercepting all outbound emails, including password reset links
5. Using intercepted password reset tokens to compromise user accounts

For technical implementation details, refer to the WordPress SendMachine Admin Code and WordPress SendMachine Email Manager Code.

Detection Methods for CVE-2026-6235

Indicators of Compromise

• Unexpected changes to WordPress SMTP configuration settings in the Sendmachine plugin
• Outbound emails being routed to unfamiliar or suspicious mail servers
• Users reporting non-receipt of expected emails such as password resets or notifications
• HTTP requests to Sendmachine admin endpoints from unauthenticated sources in web server logs
• Modified plugin database options related to email configuration

Detection Strategies

• Monitor WordPress options table for unauthorized modifications to Sendmachine SMTP settings
• Implement web application firewall (WAF) rules to detect and block suspicious requests targeting the plugin's admin functions
• Review web server access logs for POST requests to Sendmachine endpoints from external IPs
• Set up integrity monitoring on plugin configuration values stored in the database

Monitoring Recommendations

• Configure alerts for any SMTP configuration changes in the WordPress admin panel
• Monitor email delivery logs for routing changes or delivery failures
• Implement file and database integrity monitoring for the Sendmachine plugin directory and related options
• Review authentication logs for unusual account recovery attempts following email interception

How to Mitigate CVE-2026-6235

Immediate Actions Required

• Update the Sendmachine for WordPress plugin to a patched version immediately if available
• If no patch is available, deactivate and remove the Sendmachine plugin until a fix is released
• Audit current SMTP configuration settings to verify they have not been tampered with
• Review recent password reset requests and user account activity for signs of compromise
• Consider implementing a web application firewall (WAF) rule to block unauthorized access to the vulnerable endpoints

Patch Information

Affected versions include all releases up to and including version 1.0.20. Site administrators should check the WordPress plugin repository for updated versions that address this vulnerability. Additional technical analysis is available from the Wordfence Vulnerability Analysis.

Workarounds

• Disable the Sendmachine plugin entirely until a security patch is available
• Implement IP-based access restrictions to the WordPress admin area and plugin endpoints
• Use a security plugin with virtual patching capabilities to block exploitation attempts
• Configure server-level access controls to restrict requests to vulnerable endpoints
• Monitor and validate SMTP settings regularly through manual inspection

# Disable Sendmachine plugin via WP-CLI until patched
wp plugin deactivate sendmachine

# Verify current SMTP configuration has not been modified
wp option get sendmachine_smtp_settings

# List recent plugin option changes for audit
wp option list --search="sendmachine*" --format=table