Sendmachine for WordPress

Sendmachine for WordPress has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 9.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.

The most common weakness is Missing Authorization, behind 1 of the records (100%).

The one issue recorded for Sendmachine for WordPress has a vendor fix available, so running the current release closes it.

All of these findings were reported by Nabil Irawan. Sendmachine for WordPress is installed on roughly 60 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.3.

Strategic Overview

Avg CVSSCritical
9.8/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Sendmachine for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-6235

Sendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests

Read the full analysis

Vulnerability Records

1 records
Sendmachine for WordPress banner
Latestv2.0.4

Sendmachine for WordPress

sendmachine

Author

sendmachine

5.0(1)
100/100
Last Updated
2026-05-25 (3mo ago)
Active Installs
60+
Downloads
3,967
Requires WP
3.2.1+
Requires PHP
5.4+
Tested up to
WP 7.0.3
Created
2015-08-21 (11y ago)

Sendmachine’s official plugin will enable you to: Set up signup forms You can set up a signup form in a few easy steps: connect using the provided API credentials, select a contact list where your visitors will subscribe and you’re basically good to go. The signup form is available as a widget (in your widget area) or as a shortlink by pasting [sm_subscribe_form] in a post or page. Add subscribe checkboxes Allow users to subscribe to your contact list only by checking a checkbox in certain website areas like comment form or register form. Sync your wordpress users with a specific contact list You want to send emails to all your users but don’t know how? Well, don’t worry, we can help you with that. After you’ve successfully selected a contact list, you can use the “Sync users” button, to subscribe all your users to that contact list. Send emails through our services No need for nasty, geeky configurations. Just set a from email, an optional from name and you are good to go. Also, make sure that “enable email sending” is set to on. If you set a from email that doesn’t already exist in your sendmachine account as a sender address, a confirmation email will be generated and sent to that address. Not quite sure if you’ve done everything right? You can test if everything is ok by sending a test email. If you got the mail, you can sit back and relax: you’ve done it, otherwise something went wrong. Send transactional emails No more “dog ate my email” excuses. Using our services you can now monitor an email’s activity (opens, clicks, geolocations, user agents). In order to enable this option, after you install our plugin, go to “email settings” tab and check that “Register” and/or “Comment” checkboxes. Basically, if you tick that checkboxes on each email sent, that coresponds with that action, we add a custom tracking header: X-Sendmachine-Campaign: campaign_name, where campaign_name is the name of the transactional campaign that will be created, or updated if already exists. Campaign’s name can be found/modified next to every action’s checkbox. Send news feed You can send a newsletter directly from the admin panel with the latest posts. You can choose to build your newsletter with the latest 5, 10, 15 or 20 posts, set newsletter’s width, color and content. External Services This plugin connects to the following Sendmachine services: 1. Sendmachine REST API Used for list, campaign management and statistics. Specifically: Authenticates your account using your API credentials (username and password). Retrieves your contact lists, sender addresses, and SMTP connection settings. Subscribes visitors to your chosen contact list, including their email address and any additional form fields they complete. Creates, and sends email campaigns containing your latest blog posts. Retrieves your account’s email credit usage for the dashboard. This service is contacted whenever you perform any of the above actions from the WordPress admin or from a front-end subscribe form. 2. Sendmachine SMTP When the email sending service is enabled and configured, all outgoing emails from your WordPress site are routed through Sendmachine’s SMTP servers. This includes core WordPress emails such as password resets, new user registrations, and comment notifications, as well as any emails sent by other plugins or themes. Service: https://www.sendmachine.com Privacy Policy: https://www.sendmachine.com/confidentialitate.html Terms of Service: https://www.sendmachine.com/termeni-si-conditii.html

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C