YesWiki CVE-2026-104446

Exploitation requires the target to be a YesWiki instance earlier than 4.6.7 that is internet-reachable and has a functioning/configured SMTP mail backend behind its contact feature; the specific trigger is a POST XMLHttpRequest to the contact mail AJAX handler with the field and type parameters omitted, which bypasses the authentication/validation check. No credentials, user interaction, or non-default configuration are needed beyond the contact-mail functionality being operational (AV:N/AC:L/PR:N/UI:N). The principal limiting factor is that impact is confined to unauthorized outbound email (open relay) - there is no access to wiki data, no code execution, and abuse value depends on the server's SMTP being able to actually deliver mail.

This is a moderate, not critical, issue despite the 6.9 CVSS 4.0 score. The vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms genuine remote, unauthenticated, low-complexity exploitation with no user interaction, which is the main driver of the score. However, the impact is deliberately scoped as VI:L/VA:L with VC:N - there is NO confidentiality impact and NO code execution; the flaw turns the wiki's contact handler into an open mail relay (CWE-306, missing authentication). No EPSS score was provided in the input and the CVE is NOT on CISA KEV, so there is no evidence of widespread or active exploitation. No public exploit (POC) is identified in the provided data. The practical risk is reputational and operational: the victim's SMTP server/domain is abused for spam and phishing, risking blocklisting and deliverability loss, rather than compromise of the wiki host or its data. Signals are consistent (network-reachable, unauthenticated, limited integrity/availability impact) with no conflicts to flag; the real priority is elevated by ease of abuse at scale but bounded by the low technical impact.

An attacker enumerates internet-facing YesWiki instances below 4.6.7 and sends a crafted XMLHttpRequest POST to the contact mail AJAX handler, omitting the expected field/type parameters to bypass authentication. By supplying arbitrary recipient, sender, subject and body, they relay bulk phishing or spam through the wiki's SMTP configuration, abusing the victim domain's reputation. No public exploit code is identified at time of analysis, but exploitation requires no authentication and no user interaction.