CVE-2026-6235 is an authorization bypass vulnerability in the Sendmachine for WordPress plugin, affecting all versions up to and including 1.0.20. The vulnerability arises because the 'manage_admin_requests' function does not properly verify user authorization, allowing unauthenticated attackers to modify SMTP settings. This can be exploited to intercept outbound emails, including password reset messages, potentially compromising user accounts. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation allows unauthenticated attackers to overwrite SMTP configuration, enabling interception of all outbound emails from the WordPress site. This includes sensitive communications such as password reset emails, which could lead to account compromise and further unauthorized access. The vulnerability affects confidentiality, integrity, and availability of email communications handled by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the WordPress admin interface and monitor for suspicious activity. Consider disabling or uninstalling the Sendmachine plugin if feasible to reduce risk.