WordPress
CVE-2026-1937
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Shop Manager
-
DeliverySend AJAX request to yaymail_import_state
-
ExploitBypass capability check
-
ExecutionModify default user registration role to administrator
-
ImpactRegister new admin account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | YayMail plugin version 4.3.2 or earlier; attacker must have Shop Manager role or higher on WordPress site; AJAX action yaymail_import_state must be accessible to authenticated users without proper capability validation |
| Impact | CVSS 9.8. Modified email templates can inject phishing links into legitimate order confirmation and shipping notification emails. |
| Exploit ScenarioDerived | Attacker modifies WooCommerce email templates to include phishing links or malicious JavaScript, which are then sent to all customers making purchases. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Unauthorized data modification in YayMail WooCommerce Email Customizer WordPress plugin allows unauthenticated attackers to modify email templates, potentially enabling phishing attacks against customers.
Earlier versions of this analysis (1)
Unauthorized data modification in YayMail WordPress plugin.
RemediationAI
Update YayMail plugin. Audit email templates for unauthorized modifications.
Affected ProductsAI
YayMail WooCommerce Email Customizer (all versions through current)
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-862 missing authorization. Plugin allows modification of WooCommerce email templates without proper authorization checks.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the yaymail_import_state AJAX action in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Executive ViewAI
A critical vulnerability in the YayMail WordPress plugin allows unauthorized users to escalate privileges and modify data on affected websites, potentially leading to complete account takeover and site compromise. This impacts any organization using WooCommerce with YayMail versions 4.3.2 or earlier, with no patch currently available.
Immediately disable the YayMail plugin until patch release. Implement Web Application Firewall (WAF) rules to block requests to wp-admin/admin-ajax.php containing 'yaymail_import_state' action. Restrict wp-admin access via IP allowlisting. Monitor for unauthorized user privilege escalation in access logs. Consider network segmentation to limit exposure of WordPress administrative interfaces.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
GitHub PoC
Exploit-DB