Essential Real Estate 5.3.5 - Customer+ Email Relay Allowlist Poisoning

Description

The plugin does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticated users can then send emails with attacker-controlled content to it through the site.