PT-2026-20293 · Unknown+1 · Woocommerce+1

Daniel Basta

+1

·

Publicado

2026-02-18

·

Atualizado

2026-02-27

·

CVE-2026-1937

CVSS v3.1

7.2

Alta

VetorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions YayMail – WooCommerce Email Customizer plugin for WordPress versions through 4.3.2
Description The YayMail – WooCommerce Email Customizer plugin for WordPress is susceptible to unauthorized data modification, potentially leading to privilege escalation. A missing capability check on the yaymail import state AJAX action allows authenticated attackers with Shop Manager-level access or higher to modify arbitrary options on the WordPress site. This can be exploited to elevate user privileges, such as changing the default registration role to administrator and enabling user registration for unauthorized access. The yaymail import state action is the component affected.
Recommendations Update YayMail – WooCommerce Email Customizer plugin to a version later than 4.3.2.

Correção

LPE

Missing Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-1937

Produtos afetados

Woocommerce
Yaymail – Woocommerce Email Customizer