PT-2026-3535 · WordPress · Wordpress+1

Angus Girvan · Publicado 2026-01-20 · Atualizado 2026-01-20 · CVE-2025-14348

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions weMail versions prior to 2.0.8

Description The weMail plugin for WordPress has a flaw where the REST API relies on the x-wemail-user HTTP header for user identification without confirming a valid WordPress session. This allows unauthenticated attackers, who can determine an administrator's email address (through the /wp-json/wp/v2/users endpoint), to act as that user. Successful exploitation grants access to CSV subscriber endpoints, potentially leading to the theft of Personally Identifiable Information (PII) like emails, names, and phone numbers from imported CSV files.

Recommendations Update weMail to version 2.0.8 or later.

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2025-14348

Produtos afetados

Wordpress

Webmail

Referências · 7

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3442404%40wemail%2Ftrunk&old=3423372%40wemail%2Ftrunk&sfp_email=&sfph_mail=#file1 · Nota
• https://plugins.trac.wordpress.org/browser/wemail/tags/2.0.6/includes/Rest/Csv.php#L79 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14348 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/59c0caa2-d0c2-472e-83c3-d11ad313720d?source=cve · Nota
• https://twitter.com/VulmonFeeds/status/2013616122268983417 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2013484696957788368 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/wemail/tags/2.0.6/includes/Rest/Csv.php#L85 · Nota