CVE-2026-104648 weMail <= 2.1.6 - Editor+ API Key Disclosure

The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in an admin screen that users with the Editor role can reach by default, which allows them to obtain a reusable credential usable without a WordPress session to...

CVE-2026-104648

The weMail WordPress plugin (versions through 2.1.6 ) contains a vulnerability where a site-wide third-party email-service API key is not restricted to administrators. This key is exposed on an admin screen accessible to users with the Editor role by default. An attacker with Editor privileges ca...