{"vulnerability": "CVE-2026-94235", "sightings": [{"uuid": "0b8e38a3-e7c0-42f9-8b95-a326d0a2886f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-94235", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117421004710293046", "content": "CVE-2026-94235 Simple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user The MemberHero  WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay phishing carrying the site's identity and domain reputation.\nhttps://www.cve.org/CVERecord?id=CVE-2026-94235https://wpscan.com/vulnerability/be83535f-9224-4dfc-ada9-9e688e703717/#CVE_2026_94235#bot", "creation_timestamp": "2026-10-11T07:05:42.978369Z"}]}