The Sendmachine for WordPress plugin suffers from a missing authorization check in the manage_admin_requests function. An attacker who can reach the plugin’s admin endpoint without authentication can overwrite the SMTP settings. This capability enables the attacker to intercept all outgoing emails, including password reset mails, effectively allowing credential theft and facilitating further phishing or social engineering campaigns.

Sendmachine for WordPress plugin, any installed version up to and including 1.0.20.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. Exploitation requires no authentication and can be performed from any network scope that can reach the WordPress admin interface. While an EPSS score is not available, the absence of a KEV listing does not diminish the seriousness of the flaw. Given the high impact and straightforward attack vector, the risk of exploitation is considered significant, especially on publicly exposed sites.