CVE-2026-94235
Received Received - Intake

Authenticated Email Sending in MemberHero WordPress Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-94235
EUVD
EUVD-2026-96734

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown MemberHero 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the MemberHero WordPress plugin (version 6.9 or below) allows any authenticated user, including low-privilege users like subscribers, to send arbitrary HTML emails to any recipient using the site's mail system. This happens because the plugin does not perform capability or nonce checks on an AJAX action, enabling unauthorized email sending.

Detection Guidance

Check if the MemberHero WordPress plugin version 6.9 or below is installed. Inspect server logs for unusual email activity or AJAX requests from non-admin users. Look for unauthorized email sending patterns.

Impact Analysis

An attacker could exploit this to send phishing emails that appear to come from your site, potentially tricking recipients into disclosing sensitive information. This could damage your site's domain reputation and trustworthiness, leading to blacklisting by email providers or security services.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if sensitive data is exposed through phishing emails sent via the site. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. Unauthorized email relaying may violate these regulations.

Mitigation Strategies

Update the MemberHero plugin to the latest version. Disable the plugin if no update is available. Restrict user roles to prevent subscribers from accessing sensitive AJAX actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94235. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart