WordPress Plugin Vulnerabilities

weMail < 1.14.14 - Unauthenticated Sensitive Information Exposure

Description

The weMail – Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to Sensitive Information Exposure via the users() function in all versions up to, and including, 1.14.13. This makes it possible for unauthenticated attackers to extract user emails.

Affects Plugins

Plugin icon
wemail
Fixed in 1.14.14

References

CVE
CVE-2025-47540
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0d997e98-dfb6-4f41-8711-7645d2a9435e

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Denver Jackson
Verified
No
WPVDB ID
83f26a8c-a72c-487b-b03a-55c785e47efb

Timeline

Publicly Published
2025-05-07 (about 1 year ago)
Added
2025-05-13 (about 1 year ago)
Last Updated
2025-05-13 (about 1 year ago)

Other

Published
Title
Published
2026-02-03
Title
Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure
Published
2023-10-03
Title
WP Ultimate Exporter < 2.4.2 - Unauthenticated Information Disclosure
Published
2025-12-30
Title
AweBooking <= 3.2.26 - Authenticated (Subscriber+) Information Exposure
Published
2025-12-06
Title
REHub Framework < 19.9.9.4 - Authenticated (Subscriber+) Information Exposure
Published
2026-03-20
Title
SMTP Mailer < 1.1.25 - Unauthenticated Information Exposure