CVE-2024-34822: Wedevs Wemail Auth Bypass Vulnerability

CVE-2024-34822 Overview

CVE-2024-34822 is a missing authorization vulnerability in the weDevs weMail plugin for WordPress. The flaw affects all versions of weMail up to and including 1.14.2. The plugin fails to enforce proper access control checks on specific plugin actions, allowing unauthenticated attackers to reach functionality that should be restricted to privileged users. The issue is classified under CWE-862: Missing Authorization and is documented in the Patchstack Vulnerability Report.

Critical Impact
Unauthenticated attackers can invoke restricted weMail plugin functionality over the network, resulting in limited integrity impact on affected WordPress sites.

Affected Products

weDevs weMail plugin for WordPress, versions up to and including 1.14.2
WordPress sites running the vulnerable weMail plugin
Any hosting environment exposing the vulnerable plugin endpoints to the network

Discovery Timeline

2024-06-11 - CVE-2024-34822 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34822

Vulnerability Analysis

The weMail plugin exposes plugin actions that lack authorization checks. An attacker can send crafted HTTP requests directly to these endpoints without authenticating. The plugin processes the requests as though they came from a legitimate privileged user. This is a classic broken access control pattern in which authentication and capability checks are missing from server-side handlers.

Because the flaw is reachable over the network without credentials or user interaction, it can be triggered from any host that can reach the WordPress site. The impact scope is limited to integrity, meaning an attacker can modify plugin state but cannot directly read sensitive data or take the site offline through this issue alone.

Root Cause

The root cause is the absence of capability and nonce verification on selected weMail plugin action handlers. WordPress plugins are expected to gate privileged actions using current_user_can() checks and wp_verify_nonce() validation. In vulnerable versions of weMail through 1.14.2, one or more action routes bypass these checks entirely, leaving the endpoints reachable by any unauthenticated requester.

Attack Vector

Exploitation requires only network access to the target WordPress installation. An attacker sends an HTTP request to the vulnerable plugin action endpoint with parameters that would normally require an authenticated administrator. Because no authorization check runs, the server executes the action. No user interaction or prior privileges are required. See the Patchstack advisory for endpoint-level detail.

Detection Methods for CVE-2024-34822

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to weMail plugin action endpoints under /wp-admin/admin-ajax.php or /wp-json/wemail/ routes.
Unexpected changes to weMail configuration, subscriber lists, or email templates without a corresponding administrator login event.
Requests to weMail endpoints originating from IP addresses that have never authenticated to the WordPress admin console.

Detection Strategies

Review WordPress access logs for requests to weMail plugin routes that lack an authenticated session cookie or nonce parameter.
Correlate plugin state changes with the WordPress user activity log to identify actions with no associated logged-in user.
Deploy a Web Application Firewall (WAF) rule that flags direct requests to weMail action handlers from unauthenticated sources.

Monitoring Recommendations

Enable audit logging on the WordPress site using a plugin such as WP Activity Log to capture plugin-level events.
Monitor outbound email volume from the WordPress mail queue for anomalous spikes that could indicate abuse of the weMail sending workflow.
Alert on modifications to the weMail plugin options table (wp_options entries prefixed with wemail_).

How to Mitigate CVE-2024-34822

Immediate Actions Required

Upgrade the weMail plugin to a version later than 1.14.2 as published by weDevs.
If an upgrade is not immediately possible, deactivate and remove the weMail plugin until a patched release is applied.
Audit the WordPress site for unauthorized configuration changes, new administrator accounts, or unexpected email campaigns.

Patch Information

weDevs addressed the missing authorization issue in a release following weMail 1.14.2. Site administrators should consult the Patchstack Vulnerability Report and the official weMail changelog for the exact fixed version and apply the update through the WordPress plugin manager.

Workarounds

Restrict access to /wp-admin/admin-ajax.php and weMail REST routes at the WAF or reverse proxy layer, allowing only trusted source IP ranges.
Disable the weMail plugin at the filesystem level by renaming its directory under wp-content/plugins/ until patching is complete.
Add capability checks in a mu-plugin that short-circuits weMail action handlers when the requester lacks the manage_options capability.

bash

# Example: block unauthenticated access to weMail endpoints at the nginx layer
location ~* /wp-admin/admin-ajax\.php {
    if ($arg_action ~* "^wemail_") {
        # Require a valid WordPress logged-in cookie
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
}