Incorrect Privilege Escalation in weMail WordPress Plugin

Executive Summary

The weMail WordPress plugin up to version 2.1.6 has an authorization flaw in its REST API checks. It incorrectly grants access to users with roles in its allowed list (defaulting to Editor and above) without properly verifying their capabilities. This allows these users to perform admin-level actions like listing all registered users with their email addresses and changing the plugin's access settings.

Useful 0 Not Useful 0

Detection Guidance

Check if the weMail WordPress plugin version is 2.1.6 or lower. Inspect REST API calls for unauthorized actions by Editor+ users. Look for unusual enumeration of user emails or modifications to plugin access-control settings.

Useful 0 Not Useful 0

Impact Analysis

If you use weMail versions up to 2.1.6, an attacker with Editor or higher privileges could exploit this to access sensitive user data like email addresses or alter the plugin's security settings. This could lead to unauthorized changes or data exposure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data (e.g., email addresses), potentially violating GDPR or HIPAA requirements for data protection and access controls. Organizations using affected versions may face compliance risks.

Useful 0 Not Useful 0

Mitigation Strategies

Update the weMail plugin to the latest version beyond 2.1.6. Review and restrict Editor+ user roles to only necessary permissions. Monitor plugin access-control configurations for unauthorized changes.

Useful 0 Not Useful 0