Vulnerabilities / Ecomail / WPSEC-2026-0157
Ecomail <= 2.4.3 - Missing Authorization to Subscription Status Modification via Webhook REST Endpoint
Medium 6.5
CWE-306Fixed in 2.5.0
- ID
- WPSEC-2026-0157
- Plugin
- Ecomail (ecomail)
- Affected
- from 2.4.0 before 2.5.0
- Remediation
- Update to 2.5.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-306
- Usage
- Plugin Not seen · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Ecomail on WPSec AttackSurface
- Fix released
- Published
Description
The Ecomail plugin for WordPress is vulnerable to unauthorized modification of data via the ecomail/v1/webhook REST endpoint in versions 2.4.0 to 2.4.3 due to the route using '__return_true' as its permission callback and requiring no secret token. This makes it possible for unauthenticated attackers to change the Ecomail subscription status meta of any user by supplying their email address. Because the response distinguished registered from unregistered addresses and echoed back the matching user ID, attackers could also enumerate registered users' email addresses.
References
- https://wpsec.com/vuln/WPSEC-2026-0157/
- https://plugins.svn.wordpress.org/ecomail/tags/2.5.0/
- https://wordpress.org/plugins/ecomail/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS