title: Coming soon and Maintenance mode < 3.6.7 - Subscriber+ Arbitrary Email Sending to Subscribed Users
description: The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users
problem types: CWE-862 Missing Authorization
affected:
{
vendor: Unknown
product: Coming soon and Maintenance mode
versions:
status: affected, versionType: custom, version: 0, lessThan: 3.5.3
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}