CVE-2024-9065

5.3 mediumEPSS 0.4%

Medium (5.3) in matbao wp helper premium. EPSS 0.4% chance of exploitation in the next 30 days.

The WP Helper Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'whp_smtp_send_mail_test' function in all versions up to, and including, 4.6.1. This makes it possible for unauthenticated attackers to send emails containing any content and originating from the vulnerable WordPress instance to any recipient. CVE-2025-24737 is likely a duplicate of this issue.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2024-10-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

matbao:wp_helper_premium

References

https://plugins.trac.wordpress.org/browser/wp-helper-lite/tags/4.6.1/functions/class.wps-frontend-setup-function.php#L55
https://plugins.trac.wordpress.org/changeset/3167825/
https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3c6d98-6f30-4a98-91c9-e77c1f960527?source=cve

Check your stack JSON