Vulnerability · Published Nov 3, 2026 · Assigned by WPScan

CVE-2026-104648weMail <= 2.1.6 - Editor+ API Key Disclosure

Medium 4.9

In plain English

A medium-severity information exposure in weMail from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.2%top 85.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to impersonate other users and sever the site's email-service connection.

Affected products (as reported)

Vendor	Product	Versions
Unknown	weMail	0 – through 2.1.6

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References

https://wpscan.com/vulnerability/5908e671-7282-48b5-90c9-e85db6b80c52/ exploit, vdb-entry, technical-description