{"id":"CVE-2026-104648","kind":"vulnerability","aliases":["CVE-2026-104648"],"related":[],"title":"WordPress weMail plugin: Editors can read site-wide email API key","description":"The weMail  WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other users and sever the site's email-service connection.","summary":"The weMail WordPress plugin through 2.1.6 shows a site-wide third-party email-service API key on an admin screen that users with the Editor role can reach by default. An Editor can copy that key and use it outside WordPress to send email as the site or disconnect its email service.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wemail","wordpress"],"not_affected_if":["admin-only-access","newer-version","plugin-absent"],"how_to_check":"- Check the installed weMail version in the plugin list or `wp plugin get wemail --field=version` (unknown whether this exact command matches the plugin slug)\n- Check whether the plugin's admin screens are reachable by users with the Editor role","fix":"- Move the plugin past `2.1.6`; the fixed version is unknown from the sources","status":"open","published_at":"2026-11-03T06:17:37+00:00","first_seen_at":"2026-11-03T06:18:58+00:00","triaged_at":"2026-11-03T06:20:55+00:00","updated_at":"2026-11-03T06:20:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T06:20:55Z","model":"claude-haiku-5-5","output":{"fix":"- Move the plugin past `2.1.6`; the fixed version is unknown from the sources","reach":"internet","title":"WordPress weMail plugin: Editors can read site-wide email API key","impact":"medium","summary":"The weMail WordPress plugin through 2.1.6 shows a site-wide third-party email-service API key on an admin screen that users with the Editor role can reach by default. An Editor can copy that key and use it outside WordPress to send email as the site or disconnect its email service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wemail","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Editor copies email API key and impersonates users or severs email","analyst_note":"Confirm the fixed version and whether the NVD entry or vendor advisory names a patch; the sources give only the affected range through 2.1.6.","how_to_check":"- Check the installed weMail version in the plugin list or `wp plugin get wemail --field=version` (unknown whether this exact command matches the plugin slug)\n- Check whether the plugin's admin screens are reachable by users with the Editor role\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-absent","newer-version","admin-only-access"],"who_is_affected":"Sites running the weMail WordPress plugin through version 2.1.6 that have an email-service API key configured. The exposure is through the admin screen, so sites where only administrators can reach the plugin are less exposed. unknown whether other configurations are affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4128,"output_tokens":590,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-104648':15A,18A '-2026':14A,17A '2.1.6':30B,85C 'admin':46B,107C 'administr':102C 'allow':120C 'api':11A,42B,99C 'connect':144C 'copi':61B 'credenti':126C 'cve':13A,16A 'default':57B,118C 'disconnect':76B 'editor':4A,52B,59B,113C 'email':10A,40B,71B,78B,97C,142C 'email-servic':39B,96C,141C 'expos':103C 'host':22B 'imperson':133C 'key':12A,43B,63B,100C 'obtain':123C 'outsid':67B 'packag':19B 'parti':38B,95C 'plugin':3A,28B,83C 'reach':55B,116C 'read':6A 'restrict':88C 'reusabl':125C 'role':53B,114C 'screen':47B,108C 'self':21B 'self-host':20B 'send':70B 'servic':41B,79B,98C,143C 'session':131C 'sever':137C 'show':31B 'site':8A,34B,74B,91C,139C 'site-wid':7A,33B,90C 'third':37B,94C 'third-parti':36B,93C 'usabl':127C 'use':65B 'user':49B,110C,135C 'wemail':2A,23B,26B,81C 'wide':9A,35B,92C 'without':128C 'wordpress':1A,24B,27B,68B,82C,130C","nicknames":[],"mitigations":[],"who_affected":"Sites running the weMail WordPress plugin through version 2.1.6 that have an email-service API key configured. The exposure is through the admin screen, so sites where only administrators can reach the plugin are less exposed. unknown whether other configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wemail","wordpress"],"first_public_at":"2026-11-03T06:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104648","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104648","severity":null,"published_at":"2026-11-03T06:17:37+00:00","modified_at":"2026-11-03T06:17:37+00:00","first_seen_at":"2026-11-03T06:18:58+00:00","fetched_at":"2026-11-03T06:18:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}