The weMail WordPress plugin version 2.1.6 exposes a third‑party email‑service API key to any user with the Editor role, which is a standard non‑administrative role. This disclosure allows the attacker to obtain a reusable credential that does not require a WordPress session, enabling direct impersonation of other site users and the ability to disconnect the site’s email service. The impact is therefore both credential theft and potential privilege escalation, effectively compromising the integrity and availability of the site’s messaging functionality.

WeMail WordPress plugin, all installations of version 2.1.6 or earlier from the vendor Unknown:weMail. No specific version range beyond the cutoff is listed, so all releases up to and including 2.1.6 are affected.

The attack vector is simple: a user with the Editor role can access the default admin screen where the key is displayed. No additional network access or code execution is required. The CVE is not listed in CISA KEV, yet the combination of a widely available role, lack of rate limiting, and complete credential disclosure indicates a high likelihood of exploitation and potentially serious impact if an attacker uses the key to spoof communications or disable email services.