CVE-2026-1938: Yaycommerce Yaymail – Woocommerce Email Customizer

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized license key deletion due to a missing authorization check on the `/yaymail-license/v1/license/delete` REST endpoint in versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to delete the plugin's license key via the '/yaymail-license/v1/license/delete' endpoint granted they can obtain the REST API nonce.

Affected products

• Yaycommerce Yaymail – Woocommerce Email Customizer: up to and including 4.3.2

Published 2026-02-18. Last modified 2026-06-17.