Listen to this Post
How the mentioned CVE works:
The FunnelKit Automations plugin for WordPress has an AJAX handler function `bwfan_test_email` for sending test emails. This function lacks proper authorization checks, allowing unauthorized access. The security nonce required for verification is exposed in frontend JavaScript localization, making it accessible to all visitors, including unauthenticated users. The plugin’s `check_nonce()` function does not validate user roles, accepting the nonce from any authenticated user. Specifically, users with Subscriber-level access, the lowest privilege, can use this nonce. Attackers with subscriber accounts can extract the nonce from page source code. By crafting a POST request to the admin-ajax.php file with action bwfan_test_email, the nonce, and controlled subject and body parameters, they can send arbitrary emails from the site. This bypasses administrative restrictions and enables phishing, spam, or other malicious activities. The vulnerability exists in all plugin versions up to and including 3.6.4.1, stemming from missing authorization and nonce exposure.
Platform: WordPress FunnelKit Plugin
Version: Up to 3.6.4.1
Vulnerability: Missing Authorization
Severity: Critical
Date: 11/05/2025
Prediction: Patch after 11/05/2025
What Undercode Say:
Analytics:
grep -r "bwfan_test_email" /path/to/wordpress/
curl -s https://target.com/ | grep -o "bwfan_test_email_nonce." | cut -d "'" -f2
curl -X POST https://target.com/wp-admin/admin-ajax.php -d "action=bwfan_test_email&nonce=EXTRACTED_NONCE&subject=Test&body=Test"
How Exploit:
Authenticated attackers extract nonce from JavaScript. They send POST request to admin-ajax.php with action bwfan_test_email, nonce, and controlled subject/body to send arbitrary emails.
Protection from this CVE:
Update plugin beyond 3.6.4.1. Implement authorization checks. Restrict AJAX access.
Impact:
Phishing, spam, reputational damage, social engineering.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
