The invite-anyone plugin prior to 1.3.16 for WordPress has incorrect access control for email-based invitations.
invite anyone project invite anyone