CVE-2024-9065 describes a missing authorization vulnerability in the WP Helper Premium plugin for WordPress, specifically in the 'whp_smtp_send_mail_test' function. Because the plugin fails to verify user capabilities before allowing this function to execute, unauthenticated attackers can send emails with arbitrary content from the compromised WordPress site. This issue affects all versions up to and including 4.6.1. The vulnerability does not impact confidentiality or availability but allows unauthorized modification of data (email content). CVE-2025-24737 is likely a duplicate of this vulnerability.

An attacker can send arbitrary emails from the vulnerable WordPress instance without authentication, potentially enabling phishing or spam campaigns that appear to originate from a trusted site. There is no direct impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's functionality and consider disabling or removing the WP Helper Premium plugin if it is not essential. Monitor official matbao communications for updates or patches addressing this vulnerability.