Threats tagged 'ghsa-933g-gq9w-6rm8'

The weMail WordPress plugin versions through 2.1.6 expose a site-wide third-party email-service API key to users with the Editor role by displaying it on an admin screen accessible to them. This exposure allows Editors to obtain a reusable credential that can be used without a WordPress session to impersonate other users and disrupt the site's email-service connection.