---
id: "CVE-2026-104647"
kind: "vulnerability"
aliases: ["CVE-2026-104647"]
title: "weMail WordPress plugin: editors gain admin actions through REST API checks"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wemail", "wordpress"]
not_affected_if: ["no-editor-accounts", "plugin-not-installed"]
published_at: "2026-11-03T06:17:37+00:00"
first_seen_at: "2026-11-03T06:18:58+00:00"
updated_at: "2026-11-03T06:20:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104647", "first_seen_at": "2026-11-03T06:18:58+00:00"}]
---

# weMail WordPress plugin: editors gain admin actions through REST API checks

The weMail WordPress plugin through 2.1.6 fails to check user capabilities in its REST API, so any user with an allowed role (Editor and above by default) is treated as authorised for every action. That lets them list all registered users with email addresses and change the plugin's own access-control settings.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed weMail version in the WordPress plugins list or the plugin's main file header; `2.1.6` and earlier are described as affected.
- Review which accounts hold Editor or higher roles on the site, since those are the users who can exercise the flaw.

## Fix

- weMail plugin: unknown (sources do not state a fixed version)

## Timeline

- 2026-11-03T06:18:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104647

## From the sources

The weMail  WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail  WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail  WordPress plugin through 2.1.6's own access-control configuration.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_