Live › vulnerability › CVE-2026-104647
The weMail WordPress plugin through 2.1.6 fails to check user capabilities in its REST API, so any user with an allowed role (Editor and above by default) is treated as authorised for every action. That lets them list all registered users with email addresses and change the plugin's own access-control settings.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 06:18 UTC. All times on this page are UTC.
Sites running the weMail WordPress plugin version 2.1.6 or earlier are exposed, and the risk is greatest where many users hold Editor or higher roles. Sites without weMail installed, or running a version the sources do not list as affected, can skip it. The sources do not say whether the flaw needs a particular plugin setting.
No product ranges from the sources yet.
2.1.6 and earlier are described as affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail WordPress plugin through 2.1.6's own access-control configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-104647")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.