The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.
El complemento Qubely WordPress anterior a 1.8.6 permite a usuarios no autenticados enviar correos electrónicos arbitrarios a direcciones arbitrarias mediante la acción qubely_send_form_data AJAX.
The Qubely plugin for WordPress is vulnerable to unauthorized arbitrary e-mail sending in versions up to, and including, 1.8.5. This is due to insufficient validation on the presence of a contact form block and validation on the email fields in the qubely_send_form_data() function called via an AJAX action. This makes it possible for unauthenticated attackers to send emails with arbitrary content to arbitrary addresses.
