MemberHero CVE-2026-94235

Requires the MemberHero plugin version 6.9 or earlier installed and active, plus any authenticated account at subscriber level or above - exploitation is therefore gated on having (or being able to register) a low-privileged account, which is trivially satisfied on sites that allow open/self-service user registration (common for membership-oriented sites using this plugin). The vulnerable AJAX action performs no capability or nonce check, so no CSRF token or administrative privilege is needed once authenticated. Limiting factors: authentication (PR:L) is mandatory, so purely unauthenticated attackers cannot exploit it; sites that disable open registration and tightly control account creation materially reduce exposure, and the impact is confined to outbound email relay (no direct data disclosure or site compromise).

This is a medium-severity (CVSS 4.3) broken-access-control / missing-authorization issue (CWE-862) rather than a high-priority remote-code-execution class flaw. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates network-reachable, low-complexity exploitation requiring a low-privileged authenticated account (PR:L), with no user interaction, an unchanged scope, and only a low integrity impact (C:N/I:L/A:N) - the integrity impact reflects the ability to make the site emit arbitrary emails, not to alter site data. Publicly available exploit code exists (reported by WPScan), which raises practical exploitability, but the issue is NOT in CISA KEV and no EPSS exploitation-probability score was supplied, so there is no evidence of active or widespread exploitation at time of analysis. The signals are internally consistent (the description's 'any authenticated user, such as a subscriber' matches PR:L, and the AJAX/network delivery matches AV:N), so there is no vector-versus-description conflict to flag. Real-world priority is moderate-but-contextual: the technical CVSS impact is low, yet the business risk - abuse of the site's own mail system to relay phishing under the site's domain and reputation - can be material for sites with open user registration, potentially causing domain blacklisting and brand damage. EPSS is absent (not low - simply not provided), so prioritization should lean on the confirmed POC plus the specific abuse potential rather than a probabilistic score.

An attacker self-registers (or uses any existing low-privilege account such as a subscriber) on a WordPress site running MemberHero 6.9 or earlier, then directly calls the unprotected AJAX action, which performs no capability or nonce check. Because public exploit code is available from WPScan, the attacker can submit arbitrary recipient addresses and arbitrary HTML bodies, causing the site to send phishing emails from its own trusted mail system and domain.