https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 15:44:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349086 EUVD-2026-349086 https://cve.radiocsirt.org/vuln/euvd-2026-349086 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6235 <p>The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the &#39;manage_admin_requests&#39; function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the plugin&#39;s SMTP configuration, which can be leveraged to intercept all outbound emails from the site (including password reset emails).</p> <p>The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the &#39;manage_admin_requests&#39; function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the plugin&#39;s SMTP configuration, which can be leveraged to intercept all outbound emails from the site (including password reset emails).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-6235 https://cve.radiocsirt.org/vuln/ghsa-4x86-c4g3-px96 <p>The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the &#39;manage_admin_requests&#39; function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the plugin&#39;s SMTP configuration, which can be leveraged to intercept all outbound emails from the site (including password reset emails).</p> <p>The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the &#39;manage_admin_requests&#39; function in all versions up to, and including, 1.0.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the plugin&#39;s SMTP configuration, which can be leveraged to intercept all outbound emails from the site (including password reset emails).</p> https://cve.radiocsirt.org/vuln/ghsa-4x86-c4g3-px96