A high-severity Cross-Site Request Forgery (CSRF) vulnerability has been discovered in the Rhys Wynne WP Email Capture plugin for WordPress. This flaw allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings or deleting subscriber data, without their knowledge. Successful exploitation could lead to data loss, service disruption, and potential compromise of sensitive user information.

The vulnerability exists because the WP Email Capture plugin fails to implement adequate CSRF protection, such as security nonces, on its administrative functions. An attacker can craft a malicious link, form, or script and deliver it to a logged-in administrator via email or a compromised website. If the administrator interacts with the malicious content, their browser will automatically send a request to the vulnerable WordPress site, including their authentication cookies, executing the attacker's desired actions with the administrator's privileges.

This vulnerability is rated as High severity with a CVSS score of 8.8. A successful exploit could have significant business consequences, including unauthorized modification of email capture forms, deletion of entire subscriber lists, or exporting sensitive subscriber data (e.g., names and email addresses), leading to a data breach. Such an incident could result in reputational damage, loss of customer trust, and potential regulatory fines related to data privacy. The ability to manipulate plugin settings could also be a stepping stone for further attacks against the website and its visitors.

Immediate Action: All organizations using the affected software must apply the security updates provided by the vendor immediately. After patching, review administrative logs for the WP Email Capture plugin to identify any unauthorized or suspicious changes that may have occurred prior to the update.

Proactive Monitoring: Security teams should monitor web server access logs for unusual POST requests to the plugin's administrative endpoints, especially those originating from unexpected referrers. Configure alerts for rapid or bulk changes to subscriber lists or plugin settings. Monitor for any unauthorized administrative sessions.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) with rules specifically designed to detect and block CSRF attacks. Enforce a strict policy requiring administrators to log out of the WordPress dashboard when their session is complete to minimize the window of opportunity for an attack. Restricting access to the /wp-admin directory to trusted IP addresses can also significantly reduce the risk.

Public Exploit Available: false

Due to the high severity (CVSS 8.8) of this vulnerability, we strongly recommend that organizations prioritize the immediate application of the vendor-supplied patch. Although this CVE is not currently listed on the CISA KEV catalog, its potential for causing significant data loss and service disruption warrants urgent attention. All remediation and monitoring steps outlined in this report should be implemented to protect against potential exploitation and ensure the integrity of your website and subscriber data.