CVE-2025-14348

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14348", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-09T15:13:36.266Z", "datePublished": "2026-01-20T04:35:46.497Z", "dateUpdated": "2026-04-08T16:54:54.625Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:54.625Z"}, "affected": [{"vendor": "wedevs", "product": "weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.7. This is due to the plugin's REST API trusting the `x-wemail-user` HTTP header to identify users without verifying the request originates from an authenticated WordPress session. This makes it possible for unauthenticated attackers who know or can guess an admin email (easily enumerable via `/wp-json/wp/v2/users`) to impersonate that user and access the CSV subscriber endpoints, potentially exfiltrating subscriber PII (emails, names, phone numbers) from imported CSV files."}], "title": "weMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/59c0caa2-d0c2-472e-83c3-d11ad313720d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wemail/tags/2.0.6/includes/Rest/Csv.php#L79"}, {"url": "https://plugins.trac.wordpress.org/browser/wemail/tags/2.0.6/includes/Rest/Csv.php#L85"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3442404%40wemail%2Ftrunk&old=3423372%40wemail%2Ftrunk&sfp_email=&sfph_mail=#file1"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-285 Improper Authorization", "cweId": "CWE-285", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "timeline": [{"time": "2025-12-24T15:30:57.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-19T15:57:34.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T15:10:38.615260Z", "id": "CVE-2025-14348", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:10:45.592Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14348", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T15:10:38.615260Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:10:42.202Z"}}], "cna": {"title": "weMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure", "credits": [{"lang": "en", "type": "finder", "value": "Angus Girvan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "wedevs", "product": "weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-24T15:30:57.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-19T15:57:34.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/59c0caa2-d0c2-472e-83c3-d11ad313720d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wemail/tags/2.0.6/includes/Rest/Csv.php#L79"}, {"url": "https://plugins.trac.wordpress.org/browser/wemail/tags/2.0.6/includes/Rest/Csv.php#L85"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3442404%40wemail%2Ftrunk&old=3423372%40wemail%2Ftrunk&sfp_email=&sfph_mail=#file1"}], "descriptions": [{"lang": "en", "value": "The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.7. This is due to the plugin's REST API trusting the `x-wemail-user` HTTP header to identify users without verifying the request originates from an authenticated WordPress session. This makes it possible for unauthenticated attackers who know or can guess an admin email (easily enumerable via `/wp-json/wp/v2/users`) to impersonate that user and access the CSV subscriber endpoints, potentially exfiltrating subscriber PII (emails, names, phone numbers) from imported CSV files."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:54:54.625Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14348", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:54:54.625Z", "dateReserved": "2025-12-09T15:13:36.266Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-20T04:35:46.497Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce", "vendor": "wedevs", "versions": [{"lessThanOrEqual": "2.0.7", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.7. This is due to the plugin's REST API trusting the `x-wemail-user` HTTP header to identify users without verifying the request originates from an authenticated WordPress session. This makes it possible for unauthenticated attackers who know or can guess an admin email (easily enumerable via `/wp-json/wp/v2/users`) to impersonate that user and access the CSV subscriber endpoints, potentially exfiltrating subscriber PII (emails, names, phone numbers) from imported CSV files."}, {"lang": "es", "value": "El plugin weMail - Email Marketing, Generaci\u00f3n de Leads, Formularios de Suscripci\u00f3n, Boletines por Correo Electr\u00f3nico, Pruebas A/B y Automatizaci\u00f3n para WordPress es vulnerable a una omisi\u00f3n de autorizaci\u00f3n en todas las versiones hasta la 2.0.7, inclusive. Esto se debe a que la API REST del plugin conf\u00eda en el encabezado HTTP 'x-wemail-user' para identificar usuarios sin verificar que la solicitud se origina de una sesi\u00f3n de WordPress autenticada. Esto hace posible que atacantes no autenticados que conocen o pueden adivinar un correo electr\u00f3nico de administrador (f\u00e1cilmente enumerable a trav\u00e9s de '/wp-json/wp/v2/users') suplanten a ese usuario y accedan a los puntos finales de suscriptores CSV, lo que podr\u00eda exfiltrar PII de suscriptores (correos electr\u00f3nicos, nombres, n\u00fameros de tel\u00e9fono) de archivos CSV importados."}], "id": "CVE-2025-14348", "lastModified": "2026-06-17T08:35:47.387", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14348", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T15:10:38.615260Z", "version": "2.0.3"}}]}, "published": "2026-01-20T05:16:04.677", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wemail/tags/2.0.6/includes/Rest/Csv.php#L79"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wemail/tags/2.0.6/includes/Rest/Csv.php#L85"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3442404%40wemail%2Ftrunk&old=3423372%40wemail%2Ftrunk&sfp_email=&sfph_mail=#file1"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/59c0caa2-d0c2-472e-83c3-d11ad313720d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T23:55:28.261813+00:00", "value": {"mitigation_remediation": ["Upgrade the weMail plugin to a version newer than 2.0.7; this removes the known authorization bypass.", "Reconfigure the WordPress REST API or the plugin itself to validate that a request originates from an authenticated and authorized session before allowing access to the CSV export endpoint; this directly addresses the CWE\u2011285 weakness.", "Restrict or disable the CSV subscriber export endpoint for non\u2011administrator users, or implement role\u2011based access controls to ensure only privileged accounts can trigger the export."], "summary": {"action": "Apply Patch", "impact": "Sensitive Information Disclosure"}, "threat_synthesis": {"affected_systems": "Any WordPress site that has the WeDevs weMail plugin installed and versions up to and including 2.0.7 are affected. Sites that rely on the CSV subscriber export feature or expose the REST end\u2011points are specifically at risk.\n", "description_and_impact": "The weMail plugin for WordPress contains an authorization bypass that occurs when its REST API accepts the custom HTTP header x\u2011wemail\u2011user as the identity of the requesting user without verifying that the request comes from an authenticated WordPress session. This flaw, a classic example of CWE\u2011285, allows a remote actor who can guess or enumerate an administrator\u2019s email address (for example via the publicly accessible /wp-json/wp/v2/users endpoint) to fabricate a request that impersonates that admin and retrieve subscriber data from the CSV export endpoint. The exposed information may include email addresses, names, and phone numbers, constituting a direct leak of personally identifiable information.\n\nactual impact: The attacker gains read-only access to subscriber lists without needing to compromise site credentials, effectively turning the plugin into a data exfiltration mechanism. Because the vulnerability is tied to an unauthenticated REST call, it is exploitable from any internet\u2011connected location.\n\ncwe reference: The root of the problem is that the application trusts user-controlled input to define authorization, a hallmark of CWE\u2011285.\n", "risk_and_exploitability": "The calculated CVSS score of 5.3 indicates a medium severity vulnerability. The EPSS score of less than 1\u202f% suggests that exploitation is currently unlikely to be widespread, and the vulnerability is not listed in CISA\u2019s KEV catalog. Nevertheless, because the flaw permits direct leakage of subscriber PII, the overall risk remains significant for sites that value the confidentiality of their contact lists. An attacker needs only to craft the appropriate header and target an enumerated administrator email to exploit the flaw, making the attack path relatively straightforward.\n"}}}}, "created": "2026-01-20T08:39:54.896878+00:00", "updated": "2026-04-22T00:00:03.950643+00:00", "vendors": ["wedevs", "wedevs$PRODUCT$wemail", "wordpress", "wordpress$PRODUCT$wordpress"]}