CVE-2026-6235

The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the plugin's SMTP configuration, which can be leveraged to intercept all outbound emails from the site (including password reset emails).

• CWE-862

• https://plugins.trac.wordpress.org/browser/sendmachine/tags/1.0.20/includes/sendmachine_email_manager.php#L39
• https://plugins.trac.wordpress.org/browser/sendmachine/tags/1.0.20/sendmachine_wp_admin.php#L174
• https://plugins.trac.wordpress.org/browser/sendmachine/tags/1.0.20/sendmachine_wp_admin.php#L183
• https://plugins.trac.wordpress.org/changeset/3511578
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7889e071-84a8-46ec-abe5-5c98980ce275?source=cve

Published

Apr 22, 2026

Last Modified

Aug 6, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62325goshs is a feature-rich single-binary file server for red te…9.1
• CVE-2026-623279Router through version 0.4.41 contains an unauthenticated i…9.3
• CVE-2026-623289Router through version 0.4.41 contain an unauthenticated in…8.7
• CVE-2026-62343ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-62348TDengine is a time-series database optimized for Internet of…5.4
• CVE-2026-62349TDengine is an open source, time-series database optimized f…8.3
• CVE-2026-62350TDengine is an open source, time-series database optimized f…7.2
• CVE-2026-62351TDengine is a time-series database optimized for Internet of…7.5
• CVE-2026-62353TDengine is a time-series database optimized for Internet of…5.4
• CVE-2026-62354Authorization handling for Parameter Context validation requ…4.3
• CVE-2026-62355TDengine is an open source, time-series database optimized f…5.4
• CVE-2026-6236The Posts map plugin for WordPress is vulnerable to Stored C…6.4