CVE-2025-14348: weMail WordPress Plugin Auth Bypass Flaw

CVE-2025-14348 Overview

The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 2.0.7. The flaw exists because the plugin's REST API trusts the x-wemail-user HTTP header to identify users without verifying that the request originates from an authenticated WordPress session. This allows unauthenticated attackers who know or can guess an admin email address to impersonate that user and access sensitive CSV subscriber endpoints, potentially exfiltrating subscriber personally identifiable information (PII) including emails, names, and phone numbers from imported CSV files.

Critical Impact

Unauthenticated attackers can bypass authorization controls to access subscriber data endpoints, leading to potential mass exfiltration of PII from WordPress sites using the weMail plugin.

Affected Products

• weMail WordPress Plugin versions up to and including 2.0.7
• WordPress installations with weMail plugin installed
• Sites exposing the WordPress REST API user enumeration endpoint (/wp-json/wp/v2/users)

Discovery Timeline

• 2026-01-20 - CVE CVE-2025-14348 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-14348

Vulnerability Analysis

This authorization bypass vulnerability (CWE-285: Improper Authorization) stems from insecure authentication handling in the weMail plugin's REST API implementation. The plugin fails to properly validate that API requests originate from authenticated WordPress sessions, instead relying solely on the x-wemail-user HTTP header for user identification.

The vulnerability is particularly exploitable because WordPress installations typically expose the /wp-json/wp/v2/users endpoint, which allows easy enumeration of admin email addresses. An attacker can first enumerate valid admin emails through this public endpoint, then craft malicious API requests with the x-wemail-user header set to impersonate those administrators.

Once authentication is bypassed, attackers gain access to CSV subscriber endpoints containing sensitive subscriber information. This could result in bulk data exfiltration of subscriber PII including email addresses, full names, and phone numbers that have been imported via CSV files.

Root Cause

The root cause is improper trust of client-supplied HTTP headers for authentication decisions. The weMail plugin's REST API implementation in includes/Rest/Csv.php accepts the x-wemail-user header value as authoritative user identification without cross-referencing it against the actual WordPress authentication state or session cookies. This violates the security principle that client-supplied data should never be trusted for authentication purposes without server-side validation.

Attack Vector

The attack can be executed remotely over the network without requiring any prior authentication. The attack sequence involves:

1. Reconnaissance: The attacker queries the WordPress REST API endpoint /wp-json/wp/v2/users to enumerate valid user accounts and their associated email addresses
2. Header Injection: The attacker crafts HTTP requests to weMail's REST API endpoints with a spoofed x-wemail-user header containing a discovered admin email address
3. Data Exfiltration: With the forged authentication, the attacker accesses CSV subscriber endpoints to download subscriber lists containing PII

The vulnerable code logic can be examined in the WordPress Plugin Code Review showing the header-based authentication mechanism.

Detection Methods for CVE-2025-14348

Indicators of Compromise

• Unusual or unauthorized API requests to weMail CSV endpoints from external IP addresses
• High volume of requests to /wp-json/wp/v2/users followed by requests to weMail REST API endpoints
• Web server logs showing requests with x-wemail-user headers from unauthenticated sessions
• Unexpected data exports or downloads of subscriber CSV files

Detection Strategies

• Monitor HTTP access logs for requests containing the x-wemail-user header without corresponding WordPress authentication cookies
• Implement anomaly detection for unusual access patterns to weMail REST API endpoints
• Deploy Web Application Firewall (WAF) rules to flag or block suspicious header manipulation attempts
• Review WordPress audit logs for unexpected CSV export activities

Monitoring Recommendations

• Enable detailed logging for all REST API requests on WordPress installations
• Configure alerting for multiple failed or suspicious authentication attempts targeting weMail endpoints
• Implement rate limiting on the /wp-json/wp/v2/users enumeration endpoint to slow reconnaissance activities
• Establish baseline access patterns for legitimate weMail API usage to identify anomalies

How to Mitigate CVE-2025-14348

Immediate Actions Required

• Update the weMail plugin to version 2.0.8 or later immediately
• Review access logs for any signs of exploitation or unauthorized data access
• Audit subscriber data to assess potential exposure
• Consider temporarily disabling the weMail plugin until patching is complete if immediate update is not possible

Patch Information

A patch addressing this vulnerability is available in the weMail plugin update. The WordPress Code Changeset shows the security fixes implemented. The patch adds proper authentication validation to ensure REST API requests are associated with legitimate WordPress sessions before processing.

For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Workarounds

• Restrict access to the WordPress REST API using server-level access controls or security plugins
• Disable the /wp-json/wp/v2/users endpoint to prevent user enumeration using WordPress security plugins
• Implement additional authentication layers such as IP allowlisting for administrative API access
• Use a Web Application Firewall to filter requests containing suspicious x-wemail-user headers from unauthenticated sources

# Apache .htaccess configuration to restrict REST API access
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/wemail/ [NC]
RewriteCond %{HTTP:X-WEMAIL-USER} .+
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
RewriteRule .* - [F,L]
</IfModule>