Threats tagged 'ghsa-cgqh-wvf2-gj9c'

The weMail WordPress plugin through version 2.1.6 has a vulnerability in its REST API permission checks that allows users with roles in the plugin's allowed-roles list (Editor and above by default) to perform administrator-level actions. This includes enumerating all registered users with their email addresses and modifying the plugin's access-control configuration.