CVE-2026-94235

MediumCVSS 4.3

Published: 11/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 11/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

The MemberHero WordPress plugin through version 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.

Risk Assessment

The risk includes using the site's mail system to send phishing emails, which can damage domain reputation and expose recipients to fraud. Even users with low privileges can abuse this function.

Recommendation

Update the MemberHero plugin to the latest version if available. If not, disable this AJAX action or restrict access to trusted administrators only.

Other vulnerabilities in MemberHero

CVE-2026-10522Critical
The MemberHero WordPress plugin through version 6.9 does not restrict which account fields can be supplied during its frontend registration process. This allows unauthenticated attackers to register a new user with an arbitrary role, including Administrator, leading to a full site takeover. Version 6.9 is advertised as resolving this issue, but the fix is incomplete and the current version remains exploitable.

Original NVD description (English source)

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS