Unauthorized Data Modification in YayMail – WooCommerce Email Customizer Plugin

CVE-2026-1937

What is CVE-2026-1937?

The YayMail – WooCommerce Email Customizer plugin for WordPress is susceptible to unauthorized data modification due to a lack of necessary capability checks on the yaymail_import_state AJAX action. This vulnerability affects all versions up to and including 4.3.2, allowing authenticated users with Shop Manager-level access and above to arbitrarily update critical site options. Notably, this can enable malicious actors to alter the default user role settings to administrator, facilitating unauthorized user registration and potential site takeover.

References