What is the CVSS score of EUVD-2026-36945?

EUVD-2026-36945 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of YayMail are affected by EUVD-2026-36945?

The YayMail WordPress plugin (versions ≤ 4.3.3) contains a PHP deserialization vulnerability allowing authenticated Shop Manager users to execute arbitrary code and compromise site integrity,…

How to fix or mitigate EUVD-2026-36945?

Within 24 hours: Audit all WordPress installations for YayMail ≤ 4.3.3; restrict Shop Manager role assignment to essential personnel only; enable detailed admin action logging. Within 7 days: Test upgrading to YayMail 4.3.4 or later if released; evaluate alternative email plugins without known vulnerabilities; document all current Shop Manager role holders. Within 30 days: Migrate to patched YayMail version or approved alternative; conduct access review and implement principle of least privilege for all WordPress administrative roles.

YayMail EUVD-2026-36945

| CVE-2026-39498 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-h674-wp7j-pj7m

PHP Deserialization Yaymail

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable WordPress admin (AV:N, AC:L), requires Shop Manager role (PR:H), no user interaction (UI:N); PHP object injection typically yields full C/I/A within the web app scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:26 vuln.today

DescriptionCVE.org

Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.

AnalysisAI

PHP Object Injection in the YayMail WordPress plugin (versions ≤ 4.3.3) allows authenticated users with Shop Manager privileges to inject crafted serialized PHP objects and trigger deserialization on the server. Successful exploitation can lead to high-impact compromise of confidentiality, integrity, and availability of the WordPress site, though no public exploit identified at time of analysis. The flaw is reported by Patchstack and tracked as EUVD-2026-36945.

Technical ContextAI

YayMail is a WooCommerce email customizer plugin (vendor yeeaddons, CPE cpe:2.3:a:yeeaddons:yaymail) that lets shop staff design transactional emails inside WordPress. The CWE-502 Deserialization of Untrusted Data weakness occurs when PHP's unserialize() is called on attacker-controlled input, allowing crafted serialized payloads to instantiate arbitrary classes and invoke their magic methods (__wakeup, __destruct, __toString). In WordPress plugin ecosystems, such gadget chains commonly leverage classes present in WordPress core, WooCommerce, or other active plugins to escalate from object injection to file write, SQL execution, or remote code execution, depending on which gadgets are loadable in the running stack.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the provided data, so administrators should upgrade YayMail to the latest version published by yeeaddons above 4.3.3 by consulting the advisory at https://patchstack.com/database/wordpress/plugin/yaymail/vulnerability/wordpress-yaymail-plugin-4-3-3-php-object-injection-vulnerability and the WordPress plugin repository. Until patched, deactivate the YayMail plugin (side effect: loss of customized WooCommerce email templates and reversion to default emails), audit and minimize the number of accounts holding the Shop Manager role, rotate credentials for existing Shop Manager users, and enforce strong authentication plus 2FA on those accounts (side effect: minor operational friction for store staff). A virtual-patch via a WAF rule that blocks serialized PHP payloads (strings beginning with O:, a:, s: in form fields) on YayMail admin endpoints can buy time but may break legitimate plugin requests and should be tested in staging.