REST API Permission Flaw in weMail WordPress Plugin
CVE-2026-104647
Key Information:
Badges
What is CVE-2026-104647?
The weMail WordPress plugin version 2.1.6 is susceptible to an access control misconfiguration that fails to accurately verify user capabilities within its REST API permission checks. This flaw permits users assigned roles listed in the allowed-roles list, which includes roles like Editor and above, to execute privileged actions typically reserved for administrators. Consequently, these users can enumerate all registered users with associated email addresses and alter the access-control settings of the weMail plugin, potentially leading to unauthorized data exposure and manipulation.
Affected Version(s)
weMail 0 <= 2.1.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.