CyberRota Analysis
AI-GeneratedThe WPFunnels WordPress plugin prior to version 3.13.0 is vulnerable due to a lack of authorization and nonce checks in its opt-in submission handler, enabling unauthenticated users to send emails to any recipient with any subject. This flaw could lead to spam or phishing attacks, potentially damaging the site's reputation and user trust. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.