Sendmachine For Wordpress
Monthly
Authorization bypass in Sendmachine for WordPress plugin (versions ≤1.0.20) allows unauthenticated remote attackers to overwrite SMTP configuration settings without authentication. Attackers can redirect all outbound emails from WordPress sites - including password reset tokens and sensitive communications - to attacker-controlled servers, enabling credential theft and account takeover. CVSS 9.8 (Critical) reflects network attack vector with no authentication or user interaction required. No active exploitation confirmed at time of analysis, though the straightforward attack path (single HTTP request to exposed admin function) makes this a high-priority remediation target for sites using this plugin.
Authorization bypass in Sendmachine for WordPress plugin (versions ≤1.0.20) allows unauthenticated remote attackers to overwrite SMTP configuration settings without authentication. Attackers can redirect all outbound emails from WordPress sites - including password reset tokens and sensitive communications - to attacker-controlled servers, enabling credential theft and account takeover. CVSS 9.8 (Critical) reflects network attack vector with no authentication or user interaction required. No active exploitation confirmed at time of analysis, though the straightforward attack path (single HTTP request to exposed admin function) makes this a high-priority remediation target for sites using this plugin.