Threat Entry Updated 2026-02-23

CVE-2025-14339 - Wemail Plugin

The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized form deletion in all versions up to, and including, 2.0.7. This is due to the `Forms::permission()` callback only validating the `X-WP-Nonce` header without checking user capabilities. Since the REST nonce is exposed to unauthenticated visitors via the `weMail` JavaScript object on pages with weMail forms, any unauthenticated user can permanently delete all weMail forms by extracting the nonce from the page source and sending a DELETE request to…

PLUGIN Wemail

CVE-2025-14339

MEDIUM CVSS 6.5 2026-02-21

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-26

CVE-2025-14348 - Wemail Plugin

The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.7. This is due to the plugin's REST API trusting the `x-wemail-user` HTTP header to identify users without verifying the request originates from an authenticated WordPress session. This makes it possible for unauthenticated attackers who know or can guess an admin email (easily enumerable via `/wp-json/wp/v2/users`) to impersonate that user and access the CSV subscriber endpoints, potentially exfiltrating subscriber PII…

PLUGIN Wemail

CVE-2025-14348

MEDIUM CVSS 5.3 2026-01-20

Risk Score

Open Full Technical Breakdown