ZeroDay Findings
Sign inSign up

Findings

CVE-2025-14339

The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized form dele…

Published Feb 21, 2026 · updated Jun 17, 2026

The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized form deletion in all versions up to, and including, 2.0.7. This is due to the callback only validating the header without checking user capabilities. Since the REST nonce is exposed to unauthenticated visitors via the JavaScript object on pages with weMail forms, any unauthenticated user can permanently delete all weMail forms by extracting the nonce from the page source and sending a DELETE request to the forms endpoint.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 21, 2026 · NIST NVD

    Detected

    The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized form deletion in all versions up to, and including, 2.0.7. This is due to the callback only validating the header without checking user capabilities. Since the REST nonce is exposed to unauthenticated visitors via the JavaScript object on pag

  2. Jun 17, 2026 · NIST NVD

    Updated

    The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized form deletion in all versions up to, and including, 2.0.7. This is due to the callback only validating the header without checking user capabilities. Since the REST nonce is exposed to unauthenticated visitors via the JavaScript object on pag

Sources

  • CVE.orgVulnerability recordCVE-2025-14339

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2025-14339

    The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized form deletion in all versions up to, and including, 2.0.7. This is due to the callback only validati

    nvd.nist.gov

References