CVE-2026-104647
weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail WordPress plugin through 2.1.6's own access-control configuration.
| Vendor | unknown |
| Product | wemail |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wemail
Be the first to know when new unknown vulnerabilities affecting unknown wemail are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / weMail
0 ≤ 2.1.6
References
Credits
Dishant Modi WPScan