Description
The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing unauthenticated users to send arbitrary emails to any address through the site (mail relay).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Magee Shortcodes | ≤ 2.1.1 | — |
References
- https://wpscan.com/vulnerability/3adcac09-7e0f-4a43-90bd-58952aef80dd/ exploit vdb-entry technical-description