The weMail WordPress plugin allows permanently deleting all stored forms through its REST endpoint. The flaw exists in all releases up to and including 2.0.7 because the endpoint checks only a nonce header rather than authenticating the user’s permissions. An unauthenticated user can obtain that nonce from the weMail JavaScript object rendered on any page that contains a form, then construct a DELETE request to remove every form. This results in loss of form definitions, configured opt‑in settings, and associated marketing assets, severely impacting the site’s email campaigns.

WordPress sites running the weMail plugin version 2.0.7 or older. The plugin package provides email marketing, lead generation, opt‑in forms, newsletters, A/B testing, and automation functionality.

The CVSS base score is 6.5, categorising the flaw as moderate. The EPSS score is below 1 %, and the vulnerability has not yet been added to CISA’s KEV catalog, indicating a low current exploitation probability. Nevertheless the attack is straightforward: any visitor to a page containing a weMail form can extract the nonce and send a DELETE request to the /wp‑json/wemail/v1/forms endpoint. Because no authentication or capability check is performed, the attack does not require additional privileges, making it simple for attackers to destroy all form data without detection.