Vulnerability · Published Nov 3, 2026 · Assigned by WPScan

CVE-2026-104647weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()

Low 3.8

In plain English

A low-severity incorrect authorization in weMail from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)3.8Low

Exploit odds (30 days)0.2%top 95.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail WordPress plugin through 2.1.6's own access-control configuration.

Affected products (as reported)

Vendor	Product	Versions
Unknown	weMail	0 – through 2.1.6

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

References

https://wpscan.com/vulnerability/ab92c7f7-c74f-4af4-819f-b582a5a7f9d1/ exploit, vdb-entry, technical-description