weMail CVE-2026-8089

Exploitation requires the target site to run weMail below 2.1.3 and requires a victim who is already authenticated to WordPress (ideally an administrator) to click an attacker-crafted URL - the UI:R user-interaction requirement is the primary limiting factor. No attacker authentication is needed (PR:N, unauthenticated delivery), and the vulnerable AJAX response is not nonce-protected, so no valid CSRF token is required to reach the reflection. The attack is not automatable at scale (SSVC Automatable: no) precisely because it depends on social-engineering a logged-in user; impact is bounded by the privileges of whichever authenticated user opens the link.

Signals are mixed and point to a moderate, opportunistic risk rather than a top-priority emergency. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L): network-reachable, low complexity, no privileges, but requiring user interaction, with a scope change reflecting that injected script executes in the victim's authenticated session. SSVC aligns with this - Exploitation: poc, Automatable: no (because a victim must click a crafted link, so it cannot be mass-automated), Technical Impact: partial. EPSS is low at 0.21% (11th percentile) and the CVE is NOT on CISA KEV, indicating no confirmed widespread exploitation despite public POC. The practical priority driver is that the injected script runs against administrators, so a single successful lure can escalate to full site compromise. Net: a real but interaction-gated issue - patch promptly, but it is not a wormable, unauthenticated-RCE-class event.

An attacker crafts a URL to the vulnerable, non-nonce-protected weMail AJAX endpoint with a malicious payload in the reflected parameter and delivers it to a logged-in WordPress administrator (via email, comment, or messaging). When the admin opens the link, the unescaped payload breaks out of the HTML attribute and executes JavaScript in their authenticated session, allowing the attacker to steal session cookies, create rogue admin accounts, or perform actions as the admin. Public exploit code from WPScan lowers the skill needed to reproduce this low-complexity, network-delivered attack.