The weMail WordPress plugin mischecks user capabilities in its REST API, granting any user with Editor or higher privileges full administrative access to the plugin. This flaw allows an attacker to enumerate all registered users and their email addresses, as well as modify the plugin’s configuration, thereby compromising confidentiality and integrity. The vulnerability represents a classic broken access control that could be leveraged to elevate privileges or harvest sensitive data.

The affected software is the weMail WordPress plugin through version 2.1.6 and earlier. Any WordPress site deploying these plugin versions is impacted; the plugin’s default allowed‑roles list includes Editor and above, so sites that grant these roles are susceptible.

The flaw is exploitable via the plugin’s REST API, which is reachable over HTTP/HTTPS on the WordPress site. Because the plugin treats any Editor+ user as fully authorized, an attacker who gains access to such an account—through credential compromise or social engineering—can perform privileged actions without further authentication. No EPSS or KEV information and no CVSS score are provided, but the confirmed privilege escalation and data disclosure capabilities indicate a moderate‑to‑high risk, especially for sites with active editor accounts.