CVE-2026-104648: Security vulnerability

Published Nov 3, 2026

Updated

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other users and sever the site's email-service connection.

Event History

Nov 3, 2026

CVE Published

via NVD·06:17 AM

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which users can access the exposed credential by default?

Users with the WordPress Editor role can reach the affected admin screen by default. Administrators are not the only users able to access the site-wide third-party email-service API key.

What can someone do with the API key after obtaining it?

The key is reusable outside the WordPress session. An Editor who obtains it can use it to impersonate other users and sever the site's connection to the email service.

Are sites affected if Editors do not have access to the relevant admin screen?

The described exposure depends on Editors being able to reach the affected admin screen. The vulnerability states that this access is available to the Editor role by default.

CVE-2026-104648: Security vulnerability

Event History

Frequently Asked Questions

Which users can access the exposed credential by default?

What can someone do with the API key after obtaining it?

Are sites affected if Editors do not have access to the relevant admin screen?

Company

Resources

Contact

Frequently Asked Questions

Which users can access the exposed credential by default?

What can someone do with the API key after obtaining it?

Are sites affected if Editors do not have access to the relevant admin screen?