Plunk’s /webhooks/sns endpoint accepted Amazon SNS payloads without validating the SNS signature, certificate, or topic ARN. This omission let an attacker forge a webhook that appears legitimate and trigger any configured workflow automation, unsubscribe contacts, alter email delivery metrics, or consume billing credits. The weakness corresponds to CWE‑347 and can severely compromise data integrity and cost control.

The vulnerability affects Plunk deployments built on the useplunk:plunk product running any version prior to 0.9.0. Administrators should confirm the running version and upgrade if necessary.

With a CVSS score of 9.1 the vulnerability is considered critical. It is not listed in KEV and no EPSS value is available, but the lack of authentication means any malicious actor can send crafted POST requests directly to the endpoint. Successful exploitation would result in unauthorized workflow execution and potentially large financial impact through excess usage.