Email Before Download < 4.0 - SMTP Header Injection

Description

Email Before Download (https://wordpress.org/plugins/email-before-download/) before version 4.0 was vulnerable to an SMTP header injection which allows abuse of vulnerable website to send spam or phishing emails.

In email-before-download.php, the "emailFrom" variable comes directly from the "email_from" POST parameter. This variable is concatenated in the SMTP "From:" header then passed to wp_mail as the headers argument. An attacker can insert newline characters "\r\n" (URL-encoded as "%0d%0a") to add his own headers and message body.