CVE-2023-36506 – YITH WooCommerce Waiting List <= 2.6.0 - Cross-Site Request forgery via 'save_mail_status'

https://notcve.org/view.php?id=CVE-2023-36506

The YITH WooCommerce Waiting List plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.6.0. This is due to missing or incorrect nonce validation on the 'save_mail_status' function. This makes it possible for unauthenticated attackers to enable or disable email notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • CWE-862: Missing Authorization •