CVE-2024-9065 Overview
CVE-2024-9065 is a missing authorization vulnerability [CWE-862] in the WP Helper Premium plugin for WordPress, developed by Matbao. The flaw affects all versions of the plugin up to and including 4.6.1. The whp_smtp_send_mail_test function lacks a capability check, allowing unauthenticated attackers to send arbitrary emails through the vulnerable WordPress instance. Attackers can deliver messages with attacker-controlled content to arbitrary recipients, using the compromised site's mail configuration and reputation. According to NVD, CVE-2025-24737 is likely a duplicate of this issue.
Critical Impact
Unauthenticated attackers can abuse the vulnerable WordPress instance to send arbitrary emails to arbitrary recipients, enabling phishing campaigns that inherit the site's domain reputation.
Affected Products
- Matbao WP Helper Premium plugin for WordPress
- All versions up to and including 4.6.1
- WordPress sites with the plugin installed and active
Discovery Timeline
- 2024-10-10 - CVE-2024-9065 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9065
Vulnerability Analysis
The vulnerability resides in the whp_smtp_send_mail_test function within class.wps-frontend-setup-function.php of the WP Helper Premium plugin. The function is exposed through a WordPress AJAX hook without a corresponding current_user_can() capability check or nonce validation. As a result, requests can be issued by unauthenticated visitors and processed as if they came from a privileged administrator testing SMTP delivery.
Because the endpoint accepts recipient and message parameters from the request, the plugin will dispatch the email through the WordPress mail subsystem using the site's configured SMTP transport. The site's sender identity, SPF and DKIM alignment, and domain reputation are inherited by the attacker's message. This makes the vulnerability useful for phishing, business email compromise pretexting, and mass spam delivery from a trusted domain.
Root Cause
The root cause is a missing authorization check [CWE-862] on a privileged administrative function. The developer registered the SMTP test handler without gating access based on user role, capability, or nonce. Any HTTP client that can reach admin-ajax.php can invoke the handler.
Attack Vector
The attack is remote and network-based, requires no authentication, and requires no user interaction. An attacker sends a crafted POST request to the plugin's AJAX action, specifying the recipient address, subject, and message body. The vulnerable server responds by delivering the email through its own SMTP infrastructure. See the WordPress Plugin Function Code for the vulnerable implementation.
Detection Methods for CVE-2024-9065
Indicators of Compromise
- Unexpected outbound SMTP traffic originating from WordPress hosts running WP Helper Premium <= 4.6.1.
- Bounce notifications or abuse reports referencing recipients that were never legitimately contacted by the site owner.
- Access log entries containing POST requests to wp-admin/admin-ajax.php with the whp_smtp_send_mail_test action from unauthenticated sessions.
- Sudden increases in mail queue volume or SMTP relay usage on the WordPress host.
Detection Strategies
- Inspect WordPress access logs for requests to admin-ajax.php invoking the whp_smtp_send_mail_test action, particularly from IP addresses without an authenticated session cookie.
- Correlate web request logs with mail server logs to identify emails triggered by unauthenticated HTTP requests.
- Deploy a Web Application Firewall (WAF) rule that blocks unauthenticated calls to the affected AJAX action.
Monitoring Recommendations
- Monitor outbound mail volume and recipient diversity for WordPress hosts to flag anomalous send patterns.
- Enable WordPress audit logging to record plugin AJAX action usage and privilege context.
- Track domain reputation and blocklist status to detect abuse of the site's sending identity early.
How to Mitigate CVE-2024-9065
Immediate Actions Required
- Update the WP Helper Premium plugin to a version later than 4.6.1 that includes the fix from WordPress Changeset #3167825.
- If an update is not immediately available, deactivate and remove the plugin from all affected WordPress installations.
- Review mail server logs and outbound message queues for evidence of abuse and rotate SMTP credentials if unauthorized use is confirmed.
- Contact recipients of any fraudulent messages and coordinate with your abuse and reputation-monitoring teams.
Patch Information
The vendor addressed the missing capability check in a subsequent release tracked by WordPress Changeset #3167825. Additional analysis of the fix is available in the Wordfence Vulnerability Analysis. Administrators should upgrade to the patched release and validate that the whp_smtp_send_mail_test handler now enforces authentication and capability checks.
Workarounds
- Block unauthenticated POST requests to admin-ajax.php with the action=whp_smtp_send_mail_test parameter at the WAF or reverse proxy layer.
- Restrict outbound SMTP from WordPress hosts to authorized relays and enforce per-host send rate limits.
- Temporarily disable the plugin's SMTP test functionality by removing or renaming the affected function until a patched version is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
