---
id: CVE-2026-104647
title: 'weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()'
summary: >-
  The weMail  WordPress plugin through 2.1.6 does not correctly verify user
  capabilities in its REST API permission checks, treating any user whose role
  is in the weMail  WordPress plugin through 2.1.6's allowed-roles list (Editor
  and abov…
severity: low
cvss: 3.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-863
product: weMail
affected:
  - weMail <= 2.1.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T14:08:25.341366Z'
published: '2026-11-03'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:18:23.931Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-104647'
references:
  - url: 'https://wpscan.com/vulnerability/ab92c7f7-c74f-4af4-819f-b582a5a7f9d1/'
tags:
  - cve.org
epss: 0.00152
epssPercentile: 0.04423
ingestedAt: '2026-11-05T21:36:00.378Z'
---

## Overview

The weMail  WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail  WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail  WordPress plugin through 2.1.6's own access-control configuration.

## Affected

- `weMail <= 2.1.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.