CVE-2026-1831: Yaycommerce Yaymail – Woocommerce Email Customizer

Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days.

The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized plugin installation and activation due to missing capability checks on the 'yaymail_install_yaysmtp' AJAX action and `/yaymail/v1/addons/activate` REST endpoint in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to install and activate the YaySMTP plugin.

Affected products

• Yaycommerce Yaymail – Woocommerce Email Customizer: up to and including 4.3.2

Published 2026-02-18. Last modified 2026-06-17.