The Swift SMTP plugin for WordPress, which was formerly known as the Welcome Email Editor, is vulnerable to Cross-Site Request Forgery in all of its versions up to and including 5.0.6. This vulnerability is caused by either the lack of or incorrect validation on the ajax_handler() function. This flaw makes it possible for unauthenticated attackers to send emails through a fake request if they can fool a site administrator into taking action, such as clicking on a link.