CVE-2025-14339 – The weMail WordPress plugin up to version 2.0.7... (How to Fix)

Q: What is the severity of CVE-2025-14339?

CVE-2025-14339 has a CVSS score of 6.5 (MEDIUM). The weMail WordPress plugin up to version 2.0.7 allows unauthenticated attackers to permanently delete all email marketing forms. This occurs because the plugin validates only the REST API nonce without checking user permissions, and the nonce is exposed in page source code. Any WordPress site using vulnerable weMail versions is affected.

📋 TL;DR

The weMail WordPress plugin up to version 2.0.7 allows unauthenticated attackers to permanently delete all email marketing forms. This occurs because the plugin validates only the REST API nonce without checking user permissions, and the nonce is exposed in page source code. Any WordPress site using vulnerable weMail versions is affected.

💻 Affected Systems

Products:

weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress

Versions: All versions up to and including 2.0.7

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: All installations with weMail forms enabled are vulnerable; no special configuration required.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

All weMail forms are permanently deleted, disrupting email marketing campaigns, lead generation, and customer communications, requiring manual recreation.

🟠

Likely Case

Attackers delete forms to disrupt business operations, cause service degradation, or as part of broader attacks against the organization.

🟢

If Mitigated

With proper access controls and nonce validation, only authorized administrators can manage forms.

🌐 Internet-Facing: HIGH - The vulnerability is exploitable by any unauthenticated visitor to pages containing weMail forms.

🏢 Internal Only: LOW - The exposure requires internet-facing WordPress sites; internal-only deployments are less vulnerable unless exposed to untrusted users.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY - The exploit is simple and requires minimal technical skill.

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW - Attackers need only extract a nonce from page source and send a DELETE request.

Exploitation requires pages with weMail forms to expose the nonce; automated tools could scan for vulnerable sites.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.0.8 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3442404%40wemail%2Ftrunk&old=3423372%40wemail%2Ftrunk&sfp_email=&sfph_mail=#file1

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find weMail plugin and click 'Update Now' if available. 4. Alternatively, download version 2.0.8+ from WordPress.org and manually update.

🔧 Temporary Workarounds

Disable weMail plugin temporarily

linux

Deactivate the weMail plugin to prevent exploitation until patched.

wp plugin deactivate wemail

Restrict REST API access

all

Use web application firewall (WAF) rules to block DELETE requests to /wp-json/wemail/v1/forms endpoint from unauthenticated users.

🧯 If You Can't Patch

Remove weMail forms from public pages to hide the nonce from unauthenticated visitors.
Implement strict access controls and monitoring for REST API endpoints related to weMail.

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel for weMail plugin version; if version is 2.0.7 or lower, it is vulnerable.

Check Version:

wp plugin get wemail --field=version

Verify Fix Applied:

Confirm weMail plugin is updated to version 2.0.8 or later in WordPress admin.

📡 Detection & Monitoring

Log Indicators:

Unusual DELETE requests to /wp-json/wemail/v1/forms endpoint in web server logs.
Multiple failed or successful form deletion attempts from unauthenticated IPs.

Network Indicators:

HTTP DELETE requests to weMail REST API from external sources without authentication headers.

SIEM Query:

source="web_logs" AND uri="/wp-json/wemail/v1/forms" AND method="DELETE" AND user_agent NOT CONTAINS "wp-admin"

📊 Metadata

CVE ID: CVE-2025-14339

CVSS v3 Score: 6.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CWE: CWE-862

Published: February 21, 2026

Last Updated: February 23, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-14339, you might also want to check these: