Attack Vectors

CVE-2026-1831 affects the YayMail – WooCommerce Email Customizer plugin (slug: yaymail) up to version 4.3.2 and is rated Low severity (CVSS 2.7). The issue can be exploited by an already authenticated WordPress user with Shop Manager-level access or higher.

The reported paths include the yaymail_install_yaysmtp AJAX action and the /yaymail/v1/addons/activate REST endpoint, which can allow a qualified logged-in attacker to install and activate the YaySMTP plugin without proper authorization checks.

Security Weakness

The core weakness is missing authorization (capability) checks on specific YayMail actions that perform sensitive administration tasks. In business terms, this is a permission boundary problem: users who should be limited to store operations may be able to trigger a change to the site’s software configuration.

While the vulnerability does not indicate data theft on its own, it does create an avenue for unauthorized changes that can complicate governance, auditing, and change control—especially in organizations where eCommerce teams and IT/security responsibilities are separated.

Technical or Business Impacts

The direct impact described is the ability for an authenticated Shop Manager (or higher) to install and activate the YaySMTP plugin. Even with a Low severity score, the business risk comes from unapproved software being introduced and activated on a production site.

Potential business impacts include: unexpected changes to email sending behavior, interruptions to order confirmations and customer communications, additional compliance and documentation burden due to untracked configuration changes, and increased operational risk if plugin changes occur outside of normal release management.

Remediation: Update YayMail – WooCommerce Email Customizer to version 4.3.3 or newer patched versions. This is a straightforward risk-reduction step that helps maintain proper role-based control over software changes.

Similar Attacks

Authorization gaps and role misconfigurations are a common cause of “non-admin users can change admin-level settings” issues in web platforms. For additional context, here are real examples of widely documented authorization weaknesses and their business impact:

OWASP Top 10: Broken Access Control (A01:2021)
CISA Alerts and guidance on reducing exploitable conditions