Live › vulnerability › CVE-2026-104648
The weMail WordPress plugin through 2.1.6 shows a site-wide third-party email-service API key on an admin screen that users with the Editor role can reach by default. An Editor can copy that key and use it outside WordPress to send email as the site or disconnect its email service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 06:18 UTC. All times on this page are UTC.
Sites running the weMail WordPress plugin through version 2.1.6 that have an email-service API key configured. The exposure is through the admin screen, so sites where only administrators can reach the plugin are less exposed. unknown whether other configurations are affected.
No product ranges from the sources yet.
wp plugin get wemail --field=version (unknown whether this exact command matches the plugin slug)2.1.6; the fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other users and sever the site's email-service connection.
This page as .md · .json · in your agent: get_signal("CVE-2026-104648")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.