CVE-2025-14339
Received Received - Intake
Unauthorized Form Deletion in weMail WordPress Plugin via REST API

Publication date: 2026-02-21

Last updated on: 2026-02-21

Assigner: Wordfence

Description
The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized form deletion in all versions up to, and including, 2.0.7. This is due to the `Forms::permission()` callback only validating the `X-WP-Nonce` header without checking user capabilities. Since the REST nonce is exposed to unauthenticated visitors via the `weMail` JavaScript object on pages with weMail forms, any unauthenticated user can permanently delete all weMail forms by extracting the nonce from the page source and sending a DELETE request to the forms endpoint.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-21
Last Modified
2026-02-21
Generated
2026-05-07
AI Q&A
2026-02-21
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
we_devs wemail to 2.0.7 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

[{'type': 'paragraph', 'content': "The vulnerability in CVE-2025-14339 affects the weMail WordPress plugin versions up to and including 2.0.7. It arises because the plugin's REST API permission check for form deletion only verifies the presence and validity of the X-WP-Nonce header without confirming the user's capabilities."}, {'type': 'paragraph', 'content': 'Since the REST nonce is exposed to unauthenticated visitors through the weMail JavaScript object on pages containing weMail forms, any unauthenticated user can extract this nonce from the page source and send a DELETE request to the forms endpoint.'}, {'type': 'paragraph', 'content': 'This allows unauthorized users to permanently delete all weMail forms via the REST API, bypassing proper permission checks.'}] [1, 2]


How can this vulnerability impact me? :

This vulnerability can lead to unauthorized deletion of all weMail forms on a WordPress site using the affected plugin versions.

An attacker, without authentication, can permanently remove marketing, lead generation, opt-in, and newsletter forms, disrupting email marketing and automation workflows.

Such disruption can cause loss of leads, interruption of communication with subscribers, and potential damage to business operations relying on these forms.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

I don't know


How can this vulnerability be detected on my network or system? Can you suggest some commands?

[{'type': 'paragraph', 'content': "This vulnerability can be detected by monitoring for unauthorized DELETE requests to the WeMail plugin's REST API endpoint for forms, specifically the '/wemail/v1/forms' endpoint."}, {'type': 'paragraph', 'content': "Since the vulnerability involves an unauthenticated user extracting the REST nonce from the page source and sending a DELETE request, detection can involve checking web server logs or network traffic for DELETE HTTP requests targeting the '/wemail/v1/forms' REST API route."}, {'type': 'paragraph', 'content': 'Suggested commands to detect such activity include:'}, {'type': 'list_item', 'content': 'Using grep on web server access logs to find DELETE requests to the vulnerable endpoint, for example:'}, {'type': 'list_item', 'content': "grep 'DELETE /wp-json/wemail/v1/forms' /var/log/apache2/access.log"}, {'type': 'list_item', 'content': 'Or using tcpdump to capture HTTP DELETE requests to the REST API endpoint:'}, {'type': 'list_item', 'content': "tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep 'DELETE /wp-json/wemail/v1/forms'"}, {'type': 'paragraph', 'content': "Additionally, inspecting the page source of pages containing WeMail forms for the presence of the JavaScript object 'weMail' and its 'nonce' property can confirm exposure of the REST nonce to unauthenticated users."}] [1, 2]


What immediate steps should I take to mitigate this vulnerability?

[{'type': 'paragraph', 'content': 'Immediate mitigation steps include:'}, {'type': 'list_item', 'content': 'Update the WeMail plugin to a version later than 2.0.7 where this vulnerability is fixed.'}, {'type': 'list_item', 'content': "If an update is not immediately possible, restrict access to the REST API endpoints related to WeMail forms by implementing firewall rules or web server access controls to block DELETE requests to '/wp-json/wemail/v1/forms' from unauthenticated or untrusted sources."}, {'type': 'list_item', 'content': 'Monitor and audit logs for suspicious DELETE requests to the forms endpoint and respond accordingly.'}, {'type': 'list_item', 'content': 'Consider disabling or removing the WeMail plugin temporarily if the risk is high and no patch is available.'}] [1]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart