PT-2026-136025

CVE-2026-104648

Published

2026-11-03

Updated

2026-11-03

Description by

CVSS 3.1

4.9

Medium

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions weMail versions prior to 2.1.7

Description The plugin fails to restrict access to a site-wide third-party email-service API key. This sensitive credential is exposed on an admin screen accessible by default to users with the Editor role. An attacker with these privileges can obtain the key to impersonate other users and disconnect the site from its email service without requiring a WordPress session.

Recommendations Update to a version newer than 2.1.6.

Exploitability

Exploit

Fix

Impacts

Researchers

Abdullah Kareem

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers