weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()

Description

The plugin does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the plugin's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the plugin's own access-control configuration.