Lana Email Tester <= 1.0.0 - Missing Authorization to Mail Relay & Cross-Site Request Forgery

The Lana Email Tester plugin for WordPress is vulnerable to Cross-Site Request Forgery and unauthorized Mail Relay in versions up to, and including, 1.1.0. This is due to missing nonce validation on the lana_email_tester_send_test_wp_mail function as well as a missing capabilities check. This makes it possible for unauthenticated attackers to send emails from the site via forged request granted they can trick a site administrator into performing an action such as clicking on a link or via a properly crafted POST request to admin-post. This can also be exploited by authenticated users without requiring an administrator to perform an action.