The weMail plugin for WordPress contains an authorization bypass that occurs when its REST API accepts the custom HTTP header x‑wemail‑user as the identity of the requesting user without verifying that the request comes from an authenticated WordPress session. This flaw, a classic example of CWE‑285, allows a remote actor who can guess or enumerate an administrator’s email address (for example via the publicly accessible /wp-json/wp/v2/users endpoint) to fabricate a request that impersonates that admin and retrieve subscriber data from the CSV export endpoint. The exposed information may include email addresses, names, and phone numbers, constituting a direct leak of personally identifiable information. actual impact: The attacker gains read-only access to subscriber lists without needing to compromise site credentials, effectively turning the plugin into a data exfiltration mechanism. Because the vulnerability is tied to an unauthenticated REST call, it is exploitable from any internet‑connected location. cwe reference: The root of the problem is that the application trusts user-controlled input to define authorization, a hallmark of CWE‑285.

Any WordPress site that has the WeDevs weMail plugin installed and versions up to and including 2.0.7 are affected. Sites that rely on the CSV subscriber export feature or expose the REST end‑points are specifically at risk.

The calculated CVSS score of 5.3 indicates a medium severity vulnerability. The EPSS score of less than 1 % suggests that exploitation is currently unlikely to be widespread, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because the flaw permits direct leakage of subscriber PII, the overall risk remains significant for sites that value the confidentiality of their contact lists. An attacker needs only to craft the appropriate header and target an enumerated administrator email to exploit the flaw, making the attack path relatively straightforward.