WordPress Plugin Vulnerabilities
weMail <= 2.1.6 - Editor+ API Key Disclosure
Description
The plugin does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other users and sever the site's email-service connection.
Proof of Concept
Affects Plugins
No known fix References
CVE
Classification
Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Abdullah Kareem
Submitter
Abdullah Kareem
Submitter website
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-10-31 (about 2 days ago)
Added
2026-10-24 (about 9 days ago)
Last Updated
2026-10-24 (about 9 days ago)
