Unauthorized Plugin Installation Vulnerability in YayMail for WooCommerce

CVE-2026-1831

What is CVE-2026-1831?

The YayMail - WooCommerce Email Customizer for WordPress is susceptible to exploitation due to a lack of proper capability checks. This vulnerability affects all versions up to and including 4.3.2, allowing authenticated users with Shop Manager-level access or higher to exploit the 'yaymail_install_yaysmtp' AJAX action and the '/yaymail/v1/addons/activate' REST endpoint. Consequently, attackers can install and activate the YaySMTP plugin without sufficient authorization, posing significant security risks to WordPress installations using YayMail.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References