---
id: "CVE-2026-104648"
kind: "vulnerability"
aliases: ["CVE-2026-104648"]
title: "WordPress weMail plugin: Editors can read site-wide email API key"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wemail", "wordpress"]
not_affected_if: ["admin-only-access", "newer-version", "plugin-absent"]
published_at: "2026-11-03T06:17:37+00:00"
first_seen_at: "2026-11-03T06:18:58+00:00"
updated_at: "2026-11-03T06:20:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104648", "first_seen_at": "2026-11-03T06:18:58+00:00"}]
---

# WordPress weMail plugin: Editors can read site-wide email API key

The weMail WordPress plugin through 2.1.6 shows a site-wide third-party email-service API key on an admin screen that users with the Editor role can reach by default. An Editor can copy that key and use it outside WordPress to send email as the site or disconnect its email service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed weMail version in the plugin list or `wp plugin get wemail --field=version` (unknown whether this exact command matches the plugin slug)
- Check whether the plugin's admin screens are reachable by users with the Editor role

## Fix

- Move the plugin past `2.1.6`; the fixed version is unknown from the sources

## Timeline

- 2026-11-03T06:18:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104648

## From the sources

The weMail  WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other users and sever the site's email-service connection.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_