What is the CVSS score of EUVD-2026-20162?

EUVD-2026-20162 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Yaymail are affected by EUVD-2026-20162?

YayCommerce YayMail plugin versions up to 4.3.3 contain a SQL injection vulnerability that allows authenticated administrators to extract sensitive database information beyond their authorized scope.

How to fix or mitigate EUVD-2026-20162?

Within 24 hours: inventory all WordPress installations using YayMail plugin and document current versions. Within 7 days: contact YayCommerce for patch availability and timeline; implement principle of least privilege by auditing admin user accounts and removing unnecessary high-privilege access. Within 30 days: apply vendor patch immediately upon release or evaluate alternative email plugins if no patch timeline is provided; conduct database audit for unauthorized access attempts in admin logs.

Yaymail EUVD-2026-20162

| CVE-2026-39496 HIGH

SQL Injection (CWE-89)

2026-04-08 Patchstack

GHSA-rpq4-pw8v-6f38

SQLi Yaymail

7.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

Analysis Generated

Apr 15, 2026 - 12:26 vuln.today

CVSS changed

Apr 13, 2026 - 20:22 NVD

7.6 (HIGH)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20162

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayMail yaymail allows Blind SQL Injection.This issue affects YayMail: from n/a through <= 4.3.3.

AnalysisAI

SQL injection in YayCommerce YayMail plugin through version 4.3.3 enables authenticated administrators with high privileges to extract sensitive database information via blind SQL injection attacks. The vulnerability allows cross-scope confidentiality impact, meaning attackers can access data beyond their normal authorization boundaries. No public exploit identified at time of analysis, with EPSS score of 0.02% (6th percentile) indicating very low probability of exploitation in the wild.

Technical ContextAI

YayMail is a WordPress email customization plugin by YayCommerce (CPE: cpe:2.3:a:yaycommerce:yaymail). This vulnerability stems from CWE-89 (SQL Injection), where the plugin fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries. The blind SQL injection variant means attackers cannot directly see query results but can infer data through differential response analysis (timing attacks, boolean-based logic, or error messages). The CVSS Scope:Changed (S:C) metric indicates the vulnerable component can affect resources beyond its security scope, suggesting the SQL injection may access data from other WordPress tables or databases outside the plugin's intended data boundaries. WordPress plugins typically interact with the wp_ database prefix tables, but scope change implies potential lateral database access.

RemediationAI

Upgrade YayMail plugin to a version newer than 4.3.3 immediately through the WordPress admin dashboard (Plugins > Installed Plugins > YayMail > Update) or via manual installation from the official WordPress plugin repository. Vendor-released patch availability should be confirmed at the YayCommerce official site or WordPress.org plugin page, though specific patched version number is not provided in available data. As a compensatory control until patching, implement strict administrator account hygiene including multi-factor authentication enforcement, regular password rotation, principle of least privilege (limit admin role assignments), and monitoring of admin-level database queries through WordPress security plugins or database activity monitoring tools. Review WordPress admin access logs for suspicious authentication patterns or unusual database query activity that may indicate exploitation attempts. Consult Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/yaymail/vulnerability/wordpress-yaymail-plugin-4-3-3-sql-injection-vulnerability for additional technical details and vendor guidance.