A flaw in the weDevs weMail plugin up to version 1.14.13 allows attackers to retrieve embedded sensitive data, potentially exposing system information to unauthorized users. The vulnerability arises from inadequate input validation, as indicated by CWE‑497, and could lead to disclosure of credentials, configuration details, or other confidential data that the plugin processes.

WordPress sites that have the weMail plugin installed with a version that is 1.14.13 or earlier are affected. All installations of the plugin in this version range, regardless of the site’s configuration, are vulnerable.

The CVSS score of 5.3 points to a moderate impact. The EPSS score of less than 1 % indicates a low probability of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would likely need to target a vulnerable endpoint or craft a request that triggers the data retrieval, suggesting the attack vector is remote and dependent on the plugin’s exposed functionality.