Section 1.1: Details of the Plugin Issue

The WP HTML Mail plugin, widely used for crafting custom emails, contact form notifications, and other communications, has been identified as having a severe security issue. This plugin integrates seamlessly with other popular tools like WooCommerce, Ninja Forms, and BuddyPress. Although the number of sites utilizing it may not be vast, its widespread usage among sites with large audiences raises significant concerns.

Research conducted by Wordfence's Threat Intelligence team highlights that a vulnerability known as “CVE-2022–0218” could allow unauthorized users to modify email templates with harmful content. Moreover, malicious entities could exploit this flaw to dispatch phishing emails to unsuspecting users registered on compromised sites.

Subsection 1.1.1: API Security Flaw

The crux of the issue lies in the plugin's inadequate security measures for two REST-API endpoints responsible for fetching and updating email template data. These endpoints lack proper safeguards, allowing unverified users to access and execute functions that could lead to unauthorized alterations.

Section 1.2: Potential Consequences

Beyond phishing threats, an attacker could inject malicious JavaScript into the email templates. This script would execute whenever the site administrator accessed the HTML mail editor, potentially resulting in the creation of new admin accounts, redirection of users to phishing sites, insertion of backdoors into theme files, or even complete control of the website.