CVE-2025-14348 is an improper authorization vulnerability (CWE-285) in the weMail WordPress plugin (versions up to 2.0.7). The plugin's REST API improperly trusts the x-wemail-user HTTP header for user identification without verifying the request originates from an authenticated WordPress session. This flaw allows unauthenticated attackers to impersonate admin users by guessing or enumerating admin emails via the WordPress users API endpoint. Exploitation enables unauthorized access to CSV subscriber endpoints, potentially exposing subscriber PII including emails, names, and phone numbers.

The vulnerability allows unauthenticated attackers to bypass authorization controls and impersonate admin users by manipulating the x-wemail-user HTTP header. This can lead to unauthorized access to subscriber data stored in CSV files, exposing personally identifiable information such as email addresses, names, and phone numbers. There is no indication of impact on data integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is documented, users should monitor the vendor's communications for updates. As a temporary measure, restricting access to the REST API endpoints or disabling the weMail plugin until a fix is available may reduce risk. Avoid exposing admin email addresses publicly to limit attacker ability to guess valid users.