The MemberHero WordPress plugin up to version 6.9 includes an AJAX handler named wpr_send_email_to_user that is executed without checking the user’s capability or a nonce. As a result, any authenticated user—including subscribers—can invoke the action to send arbitrary HTML e‑mail to any recipient using the site’s mail system. The impact is the ability to impersonate the site’s domain and craft phishing or spam messages that look legitimate, thereby harming the site’s reputation and potentially compromising recipients’ trust.

MemberHero WordPress plugin versions up to and including 6.9. The vulnerability applies to any WordPress site that has one of these plugin versions installed; no other vendors or products are mentioned.

The CVSS score of 4.3 reflects moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, and it can be abused by any authenticated user, which lowers the barrier to entry. Successful exploitation would allow an attacker to send malicious emails that appear to come from the site’s domain, potentially impacting both the site’s reputation and the recipients’ trust.