Unauthorized License Key Deletion in YayMail – WooCommerce Email Customizer Plugin

CVE-2026-1938

What is CVE-2026-1938?

The YayMail – WooCommerce Email Customizer plugin for WordPress contains a vulnerability that allows for unauthorized deletion of license keys. This occurs due to a missing authorization check on the REST endpoint used for license management. Authenticated attackers with Shop Manager-level permissions can exploit this flaw by accessing the '/yaymail-license/v1/license/delete' endpoint, provided they have the appropriate REST API nonce. This issue affects all versions of the plugin up to and including 4.3.2.

References