CVE-2026-104648

The weMail WordPress plugin (versions through 2.1.6 ) contains a vulnerability where a site-wide third-party email-service API key is not restricted to administrators. This key is exposed on an admin screen accessible to users with the Editor role by default. An attacker with Editor privileges ca...