What the vulnerability does
01Description
The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the plugin's SMTP configuration, which can be leveraged to intercept all outbound emails from the site (including password reset emails).
Explanation of Vulnerability in Simple Terms
02Summary
Sendmachine for WordPress versions 1.0.20 and earlier lack proper authorization checks, allowing unauthenticated attackers to perform administrative actions remotely. An attacker can read, modify, or delete site data without needing valid credentials. This affects all installations of the plugin and requires immediate patching.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete site data and settings without any authentication.
Potential impact on your site
04Site Impact
Attackers can compromise your entire WordPress site, steal data, modify content, or disable functionality without your knowledge.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
April 22, 2026
CVE published
April 23, 2026
Record updated
