CVE-2026-94235: Simple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user

Q: Which users can exploit this issue?

Any authenticated WordPress user, including users with only the Subscriber role, can exploit the affected AJAX action. No elevated WordPress capability is required.

Q: What does an attacker need to do to exploit it?

The attacker needs a valid account on the WordPress site and network access to the affected AJAX endpoint. Exploitation does not require user interaction, a nonce, or special permissions.

Q: Are sites affected in their default configuration?

The issue is present because the affected AJAX action lacks both capability and nonce checks. Any site running MemberHero through version 6.9 where untrusted users can authenticate should be considered exposed.

Q: What is the likely impact if exploited?

An attacker can cause the site's mail system to send arbitrary HTML emails to arbitrary recipients. This can be used for phishing that appears to originate from the site's domain and can damage the domain's email reputation.

Q: How can administrators check for exploitation?

Review mail-system, WordPress, and web-server logs for unexpected email activity associated with MemberHero's wpr_send_email_to_user AJAX action, especially messages sent to unusual external recipients. Also review subscriber and other low-privilege accounts for unauthorized or suspicious account creation and use.

Published Oct 11, 2026

Updated

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.

Affected Software

1 affected component

Memberhero MemberHero<=6.9

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated WordPress user, including users with only the Subscriber role, can exploit the affected AJAX action. No elevated WordPress capability is required.

What does an attacker need to do to exploit it?

The attacker needs a valid account on the WordPress site and network access to the affected AJAX endpoint. Exploitation does not require user interaction, a nonce, or special permissions.

Are sites affected in their default configuration?

The issue is present because the affected AJAX action lacks both capability and nonce checks. Any site running MemberHero through version 6.9 where untrusted users can authenticate should be considered exposed.

What is the likely impact if exploited?

An attacker can cause the site's mail system to send arbitrary HTML emails to arbitrary recipients. This can be used for phishing that appears to originate from the site's domain and can damage the domain's email reputation.

How can administrators check for exploitation?

Review mail-system, WordPress, and web-server logs for unexpected email activity associated with MemberHero's wpr_send_email_to_user AJAX action, especially messages sent to unusual external recipients. Also review subscriber and other low-privilege accounts for unauthorized or suspicious account creation and use.

CVE-2026-94235: Simple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

What does an attacker need to do to exploit it?

Are sites affected in their default configuration?

What is the likely impact if exploited?

How can administrators check for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What does an attacker need to do to exploit it?

Are sites affected in their default configuration?

What is the likely impact if exploited?

How can administrators check for exploitation?