Permission Vulnerability in weMail Plugin by WordPress
CVE-2026-104648
Key Information:
Badges
What is CVE-2026-104648?
The weMail plugin for WordPress prior to version 2.1.6 contains a significant vulnerability that allows users with Editor roles to access a site-wide third-party email-service API key. This unrestricted access can lead to unauthorized actions as the key can be used to impersonate other users without needing a WordPress session, thereby breaching the integrity of the email-service connection. Site administrators need to act swiftly to mitigate this risk by ensuring proper role-based access controls are in place and updating the plugin to the latest version.
Affected Version(s)
weMail 0 <= 2.1.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.