Omnisend for WooCommerce < 1.18.1 - Unauthenticated Omnisend Account Takeover via Predictable Connect Token

Description

The plugin is vulnerable to unauthenticated Omnisend account takeover due to the `generate_install_url()` function deriving the OAuth connect token solely from the Unix timestamp at page-load time (`hash('sha256', time())`), which yields only ~86,400 distinct values per day and is trivially brute-forceable. This makes it possible for unauthenticated attackers to predict the connect token, authenticate to the `POST /wp-json/omnisend-api/v1/connect` REST endpoint, and replace the store's `omnisend_api_key` and `brand_id` with attacker-supplied values, redirecting all customer PII synchronization, order webhooks, and marketing communications to the attacker's Omnisend account.