What is the CVSS score of CVE-2026-1937?

CVE-2026-1937 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-1937?

A critical vulnerability in the YayMail WordPress plugin allows unauthorized users to escalate privileges and modify data on affected websites, potentially leading to complete account takeover and…

How to fix or mitigate CVE-2026-1937?

Within 24 hours: Identify all WordPress instances running YayMail and document affected versions; disable the plugin immediately if not business-critical. Within 7 days: Evaluate alternative email customization solutions and plan migration strategy; implement WAF rules to block yaymail_import_state AJAX requests. Within 30 days: Complete migration to patched plugin version (when released) or alternative solution; conduct access log review for signs of exploitation.

WordPress CVE-2026-1937

HIGH

Missing Authorization (CWE-862)

2026-02-18 security@wordfence.com

WordPress Privilege Escalation Authentication Bypass

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 18, 2026 - 07:16 nvd

HIGH 7.2

DescriptionCVE.org

The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the yaymail_import_state AJAX action in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

AnalysisAI

Unauthorized data modification in YayMail WooCommerce Email Customizer WordPress plugin allows unauthenticated attackers to modify email templates, potentially enabling phishing attacks against customers.