CVE-2026-42701
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The YayMail WordPress plugin in versions up to 4.4.6 contains a PHP Object Injection vulnerability exploitable by a shop manager user. This can lead to injection of a malicious PHP object and further exploitation.
Risk Assessment
An attacker with shop manager privileges could exploit the vulnerability to perform unauthorized actions, potentially leading to application compromise. The risk affects sites running the vulnerable plugin version.
Recommendation
Update the YayMail plugin to a version newer than 4.4.6. Restrict shop manager privileges to the minimum necessary until the fix is applied.
Other vulnerabilities in YayMail
See all- CVE-2026-39498High
There is a PHP Object Injection vulnerability in the shop manager in YayMail versions <= 4.3.3.
- CVE-2026-39496High
The YayMail plugin by YayCommerce up to version 4.3.3 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.
Original NVD description (English source)
Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS