{"id":"CVE-2026-104647","kind":"vulnerability","aliases":["CVE-2026-104647"],"related":[],"title":"weMail WordPress plugin: editors gain admin actions through REST API checks","description":"The weMail  WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail  WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail  WordPress plugin through 2.1.6's own access-control configuration.","summary":"The weMail WordPress plugin through 2.1.6 fails to check user capabilities in its REST API, so any user with an allowed role (Editor and above by default) is treated as authorised for every action. That lets them list all registered users with email addresses and change the plugin's own access-control settings.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wemail","wordpress"],"not_affected_if":["no-editor-accounts","plugin-not-installed"],"how_to_check":"- Check the installed weMail version in the WordPress plugins list or the plugin's main file header; `2.1.6` and earlier are described as affected.\n- Review which accounts hold Editor or higher roles on the site, since those are the users who can exercise the flaw.","fix":"- weMail plugin: unknown (sources do not state a fixed version)","status":"open","published_at":"2026-11-03T06:17:37+00:00","first_seen_at":"2026-11-03T06:18:58+00:00","triaged_at":"2026-11-03T06:20:55+00:00","updated_at":"2026-11-03T06:20:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T06:20:55Z","model":"claude-haiku-5-5","output":{"fix":"- weMail plugin: unknown (sources do not state a fixed version)","reach":"network","title":"weMail WordPress plugin: editors gain admin actions through REST API checks","impact":"medium","summary":"The weMail WordPress plugin through 2.1.6 fails to check user capabilities in its REST API, so any user with an allowed role (Editor and above by default) is treated as authorised for every action. That lets them list all registered users with email addresses and change the plugin's own access-control settings.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wemail","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Editor-level users read all user emails and change plugin access controls","analyst_note":"Check the NVD entry and the plugin vendor's changelog for a fixed version and confirm the exposure window.","how_to_check":"- Check the installed weMail version in the WordPress plugins list or the plugin's main file header; `2.1.6` and earlier are described as affected.\n- Review which accounts hold Editor or higher roles on the site, since those are the users who can exercise the flaw.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-editor-accounts"],"who_is_affected":"Sites running the weMail WordPress plugin version 2.1.6 or earlier are exposed, and the risk is greatest where many users hold Editor or higher roles. Sites without weMail installed, or running a version the sources do not list as affected, can skip it. The sources do not say whether the flaw needs a particular plugin setting.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000718,"input_tokens":4176,"output_tokens":600,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-104647':14A,17A '-2026':13A,16A '2.1.6':29B,83C,108C,150C 'access':75B,154C 'access-control':74B,153C 'action':7A,57B,123C,133C 'address':67B,142C 'admin':6A 'administr':131C 'administrator-level':130C 'allow':44B,111C,125C 'allowed-rol':110C 'api':10A,38B,93C 'authoris':54B,120C 'capabl':34B,89C 'chang':69B 'check':11A,32B,95C 'configur':156C 'control':76B,155C 'correct':86C 'cve':12A,15A 'default':50B,118C 'editor':4A,46B,114C 'email':66B,141C 'enumer':135C 'everi':56B,122C 'fail':30B 'gain':5A 'host':21B 'includ':134C 'let':59B 'level':132C 'list':61B,113C 'modifi':144C 'packag':18B 'perform':129C 'permiss':94C 'plugin':3A,27B,71B,81C,106C,148C 'regist':63B,137C 'rest':9A,37B,92C 'role':45B,100C,112C 'self':20B 'self-host':19B 'set':77B 'treat':52B,96C 'user':33B,41B,64B,88C,98C,127C,138C 'verifi':87C 'wemail':1A,22B,25B,79C,104C,146C 'whose':99C 'wordpress':2A,23B,26B,80C,105C,147C","nicknames":[],"mitigations":[],"who_affected":"Sites running the weMail WordPress plugin version 2.1.6 or earlier are exposed, and the risk is greatest where many users hold Editor or higher roles. Sites without weMail installed, or running a version the sources do not list as affected, can skip it. The sources do not say whether the flaw needs a particular plugin setting.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","wemail","wordpress"],"first_public_at":"2026-11-03T06:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104647","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104647","severity":null,"published_at":"2026-11-03T06:17:37+00:00","modified_at":"2026-11-03T06:17:37+00:00","first_seen_at":"2026-11-03T06:18:58+00:00","fetched_at":"2026-11-03T06:18:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}