What is the CVSS score of EUVD-2026-20162?

EUVD-2026-20162 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Yaymail are affected by EUVD-2026-20162?

YayCommerce YayMail plugin versions up to 4.3.3 contain a SQL injection vulnerability that allows authenticated administrators to extract sensitive database information beyond their authorized scope.

How to fix or mitigate EUVD-2026-20162?

Within 24 hours: inventory all WordPress installations using YayMail plugin and document current versions. Within 7 days: contact YayCommerce for patch availability and timeline; implement principle of least privilege by auditing admin user accounts and removing unnecessary high-privilege access. Within 30 days: apply vendor patch immediately upon release or evaluate alternative email plugins if no patch timeline is provided; conduct database audit for unauthorized access attempts in admin logs.

Yaymail EUVD-2026-20162

| CVE-2026-39496 HIGH

SQL Injection (CWE-89)

2026-04-08 Patchstack

GHSA-rpq4-pw8v-6f38

SQLi Yaymail

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 12:26 vuln.today

CVSS changed

Apr 13, 2026 - 20:22 NVD

7.6 (HIGH)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20162

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayMail yaymail allows Blind SQL Injection.This issue affects YayMail: from n/a through <= 4.3.3.

AnalysisAI

SQL injection in YayCommerce YayMail plugin through version 4.3.3 enables authenticated administrators with high privileges to extract sensitive database information via blind SQL injection attacks. The vulnerability allows cross-scope confidentiality impact, meaning attackers can access data beyond their normal authorization boundaries. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Compromise admin credentials via phishing

Delivery

Authenticate to WordPress admin panel

Exploit

Navigate to YayMail plugin interface

Install

Inject SQL payload in vulnerable parameter

Execute blind SQL queries via timing/boolean techniques

Execute

Extract database contents including cross-scope data

Impact

Exfiltrate sensitive information