CVE-2026-104648

{
  "etk_id": "ETK-2026-3346",
  "cve_id": "CVE-2026-104648",
  "display_id": "CVE-2026-104648",
  "ghsa_id": "GHSA-933g-gq9w-6rm8",
  "euvd_id": "EUVD-2026-115683",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Editor-accessible API key disclosure in weMail",
  "summary": "weMail versions through 2.1.6 expose a site-wide email-service API key through an interface reachable by default to users with the WordPress Editor role. An attacker who has an Editor account can obtain the credential and use it outside the site to impersonate users or disrupt the email-service connection.",
  "mitigation": "Remove or limit Editor accounts until the plugin is updated, and restrict access to the affected weMail administration interface. Upgrade to a weMail release newer than 2.1.6 after confirming it corrects the authorization check.",
  "vendor": null,
  "product": "weMail",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.1.6"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "weMail",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 17.8940986,
  "t0_at": "2026-11-03T06:00:24.220000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-03T07:38:01.165604+00:00",
      "days": 0.06778872226851852,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T06:00:24.220000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-03T06:00:24.220000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T06:00:24.220000+00:00",
      "url": "https://github.com/advisories/GHSA-933g-gq9w-6rm8"
    }
  }
}