CVE-2025-14339: 
WordPress vulnerability analysis and mitigation

CVE-2025-14339 is a Missing Authorization vulnerability in the weMail – Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress. It affects all versions up to and including 2.0.7, allowing unauthenticated attackers to permanently delete all weMail forms. The vulnerability was published on February 21, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-862 (Missing Authorization). The Forms::permission() callback in the plugin only validates the X-WP-Nonce header to authenticate REST API requests, but does not verify whether the requesting user has the necessary WordPress capabilities to perform destructive operations. Critically, the REST nonce is exposed to unauthenticated visitors via the weMail JavaScript object embedded on any page that contains a weMail form, meaning any visitor can extract the nonce from the page source and use it to send authenticated DELETE requests to the forms REST endpoint (Red Hat CVE, Infinit Security).

Successful exploitation allows any unauthenticated remote attacker to permanently delete all weMail forms on the affected WordPress site, resulting in loss of lead generation forms, email subscription opt-ins, and associated data. The primary impacts are to integrity and availability — form data and configurations are irreversibly destroyed, disrupting marketing workflows and potentially causing data loss. There is no confidentiality impact, and lateral movement beyond the plugin's scope is not directly enabled by this vulnerability (Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the time of publication. The EPSS score is approximately 0.047%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and lack of authentication requirements make it trivially exploitable by any attacker who can access a page with a weMail form (Red Hat CVE, Wordfence).

1. Reconnaissance: Identify a WordPress site running the weMail plugin (version ≤ 2.0.7) by visiting any page that contains a weMail opt-in or contact form.
2. Extract the nonce: View the page source or use browser developer tools to locate the weMail JavaScript object, which contains the REST API nonce (e.g., weMail.nonce).
3. Enumerate form IDs: Send authenticated GET requests to the weMail REST API forms endpoint (e.g., /wp-json/wemail/v1/forms) using the extracted nonce in the X-WP-Nonce header to list all existing form IDs.
4. Delete forms: For each form ID, send a DELETE request to the forms endpoint (e.g., DELETE /wp-json/wemail/v1/forms/{id}) with the X-WP-Nonce header set to the extracted nonce, permanently deleting each form.
5. Mass deletion: Automate steps 3–4 to delete all forms in a single script execution, causing complete loss of all weMail forms on the site (Infinit Security, Red Hat CVE).

• Network: Unusual DELETE requests to /wp-json/wemail/v1/forms/ or similar REST API endpoints originating from unauthenticated or anonymous sessions; rapid sequential DELETE requests to multiple form IDs from a single IP address.
• Logs: WordPress access logs showing DELETE HTTP method requests to weMail REST API endpoints from non-admin IP addresses; absence of corresponding authenticated user sessions in WordPress auth logs.
• Application: Sudden disappearance of all weMail forms from the WordPress admin dashboard; weMail plugin reporting no forms configured after previously having multiple forms.

Users should update the weMail plugin to a version beyond 2.0.7 that includes a fix implementing proper capability checks in the Forms::permission() callback. Until a patched version is available or applied, administrators can temporarily disable the weMail plugin or restrict access to the WordPress REST API for unauthenticated users using a security plugin or server-level rules. Regularly backing up weMail form configurations is also recommended as a precautionary measure (Red Hat CVE, Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of February 16–22, 2026, highlighting it as a notable unauthenticated authorization bypass (Wordfence). Infinit Security published a dedicated technical write-up detailing the exploitation mechanics (Infinit Security). No significant broader media coverage or notable social media discussion has been observed beyond standard vulnerability aggregator reporting.