Unauthorized License Key Deletion in YayMail – WooCommerce Email Customizer Plugin

CVE-2026-1938

What is CVE-2026-1938?

The YayMail – WooCommerce Email Customizer plugin for WordPress contains a vulnerability that allows for unauthorized deletion of license keys. This occurs due to a missing authorization check on the REST endpoint used for license management. Authenticated attackers with Shop Manager-level permissions can exploit this flaw by accessing the '/yaymail-license/v1/license/delete' endpoint, provided they have the appropriate REST API nonce. This issue affects all versions of the plugin up to and including 4.3.2.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References