PT-2026-3535 · WordPress · Wordpress+1

Angus Girvan · Published 2026-01-20 · Updated 2026-01-20 · CVE-2025-14348

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions weMail versions prior to 2.0.8

Description The weMail plugin for WordPress has a flaw where the REST API relies on the x-wemail-user HTTP header for user identification without confirming a valid WordPress session. This allows unauthenticated attackers, who can determine an administrator's email address (through the /wp-json/wp/v2/users endpoint), to act as that user. Successful exploitation grants access to CSV subscriber endpoints, potentially leading to the theft of Personally Identifiable Information (PII) like emails, names, and phone numbers from imported CSV files.

Recommendations Update weMail to version 2.0.8 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-14348

Affected Products

Wordpress

Webmail

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14348 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3442404%40wemail%2Ftrunk&old=3423372%40wemail%2Ftrunk&sfp_email=&sfph_mail=#file1 · Note
• https://plugins.trac.wordpress.org/browser/wemail/tags/2.0.6/includes/Rest/Csv.php#L79 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/59c0caa2-d0c2-472e-83c3-d11ad313720d?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2013616122268983417 · Twitter Post
• https://twitter.com/CVEnew/status/2013484696957788368 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wemail/tags/2.0.6/includes/Rest/Csv.php#L85 · Note