No rate limit on subscribe form

How it was found

Summary:

Hi team, I found that you missing a rate limit protection for subscribe form

Platform(s) Affected:

https://business.yelp.com/?source=consumer_site_header&utm_content=header&utm_medium=www&utm_source=cons_home

Steps To Reproduce:

1. go to https://business.yelp.com/?source=consumer_site_header&utm_content=header&utm_medium=www&utm_source=cons_home
2. find a form with just email input (emailsub.png)
3. fill it with email click on submit then intercept the request
4. send to burp intruder go to -> positions
5. clear §
6. add § in email like youremail§1§@gmail.com
7. go to -> payloads, add numbers type paylaod like ( from : 2 , to : 100, step: 1)
8. start attack you will see all response with 200 ok and contain msg Thanks for subscribing! so no rate limit implemented

Fix:

add a recaptcha or 429 error (many requests)

Supporting Material/References:

see screenshots

Impact

No rate limit in form.