The vulnerability allows an authenticated user with Subscriber-level access or higher to send arbitrary emails from the website. It arises because the plugin's AJAX handler for test emails does not verify proper authorization; the nonce used is exposed to all visitors and the check permits low-privilege accounts that possess the nonce. Consequently, an attacker can control subject and body content to deliver spam or phishing content without administrator approval.

WordPress sites installing the FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin, version 3.6.4.1 or earlier. The affected component is the bwfan_test_email AJAX endpoint in the plugin's core code. Administrators using older releases should verify the installed plugin version.

The CVSS score is 4.3, indicating moderate impact. The EPSS score is below 1%, suggesting low probability of widespread exploitation at this time; the vulnerability is not listed in CISA's KEV catalog. Exploitation requires only that the user is logged in as a Subscriber or higher, that the nonce is available via frontend JavaScript, and that the attacker can invoke the AJAX endpoint. The likely attack vector is via the site's frontend, using the publicly exposed nonce in a browser, allowing an attacker to trigger the AJAX call and forge email subject and body, resulting in arbitrary emails being sent from the site to any address.