WordPress Plugin Flaw Lets Attackers Hijack Site Emails
The Sendmachine for WordPress plugin harbors a critical vulnerability (CVE-2026-6235) that allows unauthenticated attackers to bypass authorization checks. This flaw, present in all versions up to 1.0.20, stems from improper verification within the ‘manage_admin_requests’ function. Attackers can exploit this to overwrite the plugin’s SMTP configuration.
The immediate impact is severe: attackers can intercept all outbound emails originating from the compromised WordPress site. This includes sensitive communications like password reset emails, effectively enabling credential harvesting and further account takeover. The National Vulnerability Database rates this vulnerability as CRITICAL with a CVSS score of 9.8.
Defenders must prioritize patching or disabling the Sendmachine for WordPress plugin immediately. Any site using this plugin is at high risk. CISOs should review their email security posture and consider implementing out-of-band email verification methods for critical functions like password resets, independent of direct plugin configurations.
What This Means For You
- If your organization uses the Sendmachine for WordPress plugin, audit your website immediately. Verify the plugin version and patch to 1.0.20 or later, or disable it entirely if patching isn't feasible. Review your SMTP configuration and logs for any unauthorized changes or suspicious email activity.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-6235 WordPress Sendmachine Plugin Authorization Bypass
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-6235 | Vulnerability | CVE-2026-6235 |
| CVE-2026-6235 | Affected Product | all |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 22, 2026 at 12:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related Posts
CVE-2026-6848 — Red Hat Quay Vulnerability
CVE-2026-6848 — A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or...
CVE-2026-33601 — Denial of Service
CVE-2026-33601 — If you use the zoneToCache function with a malicious authoritative server, an attacker can send a zone that result in a null pointer...
CVE-2026-33600 — Denial of Service
CVE-2026-33600 — An RPZ sent by a malicious authoritative server can result in a null pointer dereference, caused by a missing consistency check and leading...