high · CVSS v3 7.1

CVE-2026-104647

The weMail WordPress plugin up to version 2.1.6 fails to properly verify user capabilities in its REST API, allowing any user with a role of

Overview

The weMail WordPress plugin up to version 2.1.6 fails to properly verify user capabilities in its REST API, allowing any user with a role of Editor or higher to perform administrator‑level actions. This flaw lets attackers enumerate all registered users and their email addresses, and modify the plugin’s access‑control settings. The vulnerability can be exploited by legitimate site users with elevated roles, potentially exposing sensitive user data and compromising site configuration.

Description

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail WordPress plugin through 2.1.6's own access-control configuration.

Impact

Confidentiality: attacker can view all registered user emails, potentially enabling phishing or credential stuffing. Integrity: attacker can alter the plugin’s access‑control configuration, potentially granting themselves higher privileges or disabling security controls. Availability: no direct impact, but configuration changes could indirectly affect site stability. Defenders are impacted if they run the affected plugin version on a WordPress site.

Remediation

1. Update the weMail WordPress plugin to version 2.1.7 or later, where the REST API permission checks have been fixed. 2. If an update is not immediately possible, restrict the allowed‑roles list in the plugin settings to only trusted administrator accounts, or remove the Editor role from the list. 3. Disable the plugin’s REST API endpoints via a firewall or .htaccess rule until a patch is applied. 4. Verify that role‑based access controls are correctly enforced by testing the REST API with a non‑admin user.

Risk context

Severity: high (CVSS v3.1 7.1). No EPSS data available. The vulnerability is exploitable by any user with Editor or higher role, making it a significant risk for sites with many such users. Defenders should prioritize patching or mitigating the issue promptly.

Affected products

  • weMail WordPress plugin 2.1.6
  • WordPress

Scores

Severity
high
CVSS v2
5.5
CVSS v3
7.1
CVSS v4
—
EPSS
—

wordpress plugin rest-api authorization high-severity user-enumeration configuration

← All CVEs

Related CVEs

high

CVE-2026-119301

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later.

View analysis

high

CVE-2026-120538

The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity: edd_get_purchase_form_user() binds the new guest order to an existing WordPress user purely on an email-address match, rewriting the order's user_id to that user's ID. The PayPal capture sink PurchaseUser::maybe_log_in_after_capture() then looked the user up by the order email (get_user_by( 'email', $order->email )) and, when $order->user_id equalled that user's ID (which the email-binding step guarantees), issued an authenticated session with wp_set_auth_cookie(). An unauthenticated attacker who starts a guest checkout using an administrator's email address (where that administrator has no existing EDD customer record) and completes the PayPal purchase flow therefore receives an authenticated session as that administrator — a full account takeover. The same sink is reachable through the standard PayPal checkout and the REST UnbrandedCard and Fastlane flows.

View analysis

high

CVE-2026-120558

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST /wp-json/wc-ast/v3/orders/ /shipment-trackings` REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query in `WC_Advanced_Shipment_Tracking_Admin::get_provider_slug_from_name()` — the value is concatenated directly into the format string of `$wpdb->prepare()` rather than bound as a parameter, bypassing parameterised-query protections. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to append additional SQL queries into the already-existing query that can be used to extract sensitive information from the database.

View analysis

high

CVE-2026-120559

The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefd_remove_uploaded_file() function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The nonce protecting this AJAX action is rendered into the public page source via wp_localize_script and is therefore retrievable by any unauthenticated visitor.

View analysis