CVE-2026-115303

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticate...

WordPress Royal Elementor Addons plugin < 1.7.1070 - Unauthenticated Arbitrary Email Recipient Injection vulnerability

Unauthenticated Arbitrary Email Recipient Injection vulnerability discovered by Mohammed Abd Alrahman in WordPress Plugin Royal Elementor Addons versions 1.7.1070...

CVE-2026-94235

The MemberHero WordPress plugin (version 6.9 and below) is vulnerable to an arbitrary email sending flaw due to a missing capability and nonce check on an AJAX action. Specifically, the wpr_send_email_to_user function allows any authenticated user , such as a subscriber, to force the site to send...

CVE-2026-94235 Simple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay...

WordPress MemberHero plugin <= 6.9 - Subscriber+ Arbitrary Email Sending vulnerability

Subscriber+ Arbitrary Email Sending vulnerability discovered by Yaswanth Reddy Sunkara in WordPress Plugin Simple User Registration versions = 6.9...

CVE-2026-94235 Simple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay...

PT-2026-110068

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail system, which can be abused to relay...

BIT-GHOST-2026-103267 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

Examples for Developers - Less critical - Allocation of resources without limits or throttling - SA-CONTRIB-2026-215

The Examples for Developers project aims to provide high-quality, well-documented API examples for a broad range of Drupal core functionality. The "Email Example" feature implemented by the emailexample submodule can be used to send illegitimate emails to arbitrary email addresses. Therefore, the...

Reliance on Untrusted Inputs in a Security Decision

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the staff invite signup flow, where the email field in the invitation acceptance form was editable and user-supplied rather than being populated and...

CVE-2026-103267 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

CVE-2026-103267 Ghost 0.5.0 before 6.62.0 Arbitrary Email Registration via Staff Invite

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

CVE-2026-103267

Ghost versions before 6.62.0 are vulnerable to an authentication bypass during the staff invite acceptance process. This flaw allows users to specify arbitrary email addresses when creating an account. Specifically, attackers can utilize leaked invite tokens to register with attacker-controlled e...

EUVD-2026-90661

Ghost versions before 6.62.0 contain an authentication bypass vulnerability in staff invite acceptance that allows users to specify any email address when creating their account. Attackers can accept leaked invite tokens with attacker-controlled email addresses, or legitimate recipients can...

CVE-2026-89300 WP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Recipients

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The...

CVE-2026-87074 Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

CVE-2026-87074 Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link

The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its...

CVE-2026-87074

The Forminator Forms WordPress plugin (versions 1.17.1 through 1.57.2.0 ) is vulnerable to unauthenticated arbitrary recipient email sending. The root cause is a failure to bind saved-draft notifications to the original visitor, allowing the plugin to accept the recipient address and message link...

WordPress Forminator Forms plugin 1.17.1-1.57.2.0 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link vulnerability

Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link vulnerability discovered by vuxvinh in WordPress Plugin Forminator versions 1.17.1-1.57.2.0...

CVE-2026-86552

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via the backend interface...