sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total9
Critical0
High3
Medium5
Reset
Showing 1-9 of 9 records
Threat Entry Updated 2026-11-04

weMail - Security Vulnerability (CVE-2026-104648)

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other users and sever the site's email-service connection.

PLUGIN weMail

CVE-2026-104648

MEDIUM CVSS 4.9 2026-11-03
Open Full Technical Breakdown
Threat Entry Updated 2026-11-04

weMail - Security Vulnerability (CVE-2026-104647)

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail WordPress plugin through 2.1.6's own access-control configuration.

PLUGIN weMail

CVE-2026-104647

LOW CVSS 3.8 2026-11-03
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

weMail - Cross-Site Scripting (XSS) (CVE-2026-8089)

The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing unauthenticated attackers to deliver Reflected Cross-Site Scripting against any authenticated user (including administrators) via a crafted URL.

PLUGIN weMail

CVE-2026-8089

HIGH CVSS 7.1 2026-06-17
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Wemail - Security Vulnerability (CVE-2025-14339)

The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized form deletion in all versions up to, and including, 2.0.7. This is due to the `Forms::permission()` callback only validating the `X-WP-Nonce` header without checking user capabilities. Since the REST nonce is exposed to unauthenticated visitors via the `weMail` JavaScript object on pages with weMail forms, any unauthenticated user can permanently delete all weMail forms by extracting the nonce from the page source and sending a DELETE request to…

PLUGIN Wemail

CVE-2025-14339

MEDIUM CVSS 6.5 2026-02-21
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Wemail - Broken Access Control (CVE-2025-14348)

The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.7. This is due to the plugin's REST API trusting the `x-wemail-user` HTTP header to identify users without verifying the request originates from an authenticated WordPress session. This makes it possible for unauthenticated attackers who know or can guess an admin email (easily enumerable via `/wp-json/wp/v2/users`) to impersonate that user and access the CSV subscriber endpoints, potentially exfiltrating subscriber PII…

PLUGIN Wemail

CVE-2025-14348

MEDIUM CVSS 5.3 2026-01-20
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.