The YITH WooCommerce Waiting List plugin for WordPress is vulnerable to a security issue in versions up to 2.6.0. This means that unauthenticated attackers (people who have not logged in) can enable or disable email notifications without permission. This is done by tricking a site administrator into performing an action such as clicking on a link. This is because of a missing or incorrect validation system called a nonce on the ‘save_mail_status’ function.