The FunnelKit Automations – Email Marketing Automation and CRM plugin for WordPress & WooCommerce suffers from a Missing Authorization vulnerability (CWE-862) in its bwfan_test_email AJAX handler. The plugin exposes a nonce used for verification to all visitors, including unauthenticated users, via frontend JavaScript localization. The check_nonce() function accepts this nonce from low-privilege authenticated users, such as Subscribers, enabling them to perform administrative actions like sending arbitrary emails with attacker-controlled subject and body content. This issue affects all versions up to 3.6.4.1 and has a CVSS 3.1 base score of 4.3 (medium severity).

An attacker with at least Subscriber-level access can exploit this vulnerability to send arbitrary emails from the affected WordPress site. This could be used for phishing, spam, or other malicious email campaigns originating from a trusted domain. There is no direct confidentiality or availability impact reported. No known exploits in the wild have been documented at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles carefully to limit Subscriber-level access and monitor for suspicious email activity. Avoid exposing the vulnerable plugin on publicly accessible sites if possible.