CVE-2026-1831: YayMail WordPress Auth Bypass Vulnerability

CVE-2026-1831 Overview

The YayMail - WooCommerce Email Customizer plugin for WordPress contains a missing capability check vulnerability that allows unauthorized plugin installation and activation. The vulnerability exists in the yaymail_install_yaysmtp AJAX action and the /yaymail/v1/addons/activate REST endpoint in all versions up to and including 4.3.2. This security flaw enables authenticated attackers with Shop Manager-level access or above to install and activate the YaySMTP plugin without proper authorization checks.

Critical Impact

Authenticated attackers with Shop Manager privileges can bypass authorization controls to install and activate unauthorized plugins, potentially compromising the integrity of the WordPress installation.

Affected Products

• YayMail - WooCommerce Email Customizer plugin for WordPress versions up to and including 4.3.2
• WordPress installations with affected YayMail plugin versions
• WooCommerce stores utilizing YayMail for email customization

Discovery Timeline

• 2026-02-18 - CVE-2026-1831 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-1831

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), representing a broken access control flaw in the YayMail WordPress plugin. The security issue stems from the plugin's failure to implement proper capability checks on privileged AJAX and REST API endpoints. When users with Shop Manager roles interact with the plugin, they can invoke functionality that should be restricted to higher-privileged administrators.

The vulnerability allows authenticated users with Shop Manager-level permissions to install and activate the YaySMTP plugin through unprotected endpoints. While Shop Managers typically have elevated privileges within WooCommerce contexts, the ability to install arbitrary plugins should be reserved exclusively for site administrators. This authorization bypass could enable privilege escalation scenarios where compromised Shop Manager accounts can modify the WordPress installation beyond their intended scope.

Root Cause

The root cause is missing capability checks in the yaymail_install_yaysmtp AJAX action handler located in src/Ajax.php and the addon activation logic in src/Controllers/AddonController.php. The developers failed to implement WordPress capability verification using functions like current_user_can() before processing plugin installation requests. Without these authorization gates, any authenticated user meeting the minimum role requirement can trigger plugin installation functionality.

Attack Vector

The attack is conducted over the network and requires authentication with at least Shop Manager-level access. An attacker who has compromised or controls a Shop Manager account can send crafted AJAX requests to the yaymail_install_yaysmtp action or make REST API calls to /yaymail/v1/addons/activate to install and activate the YaySMTP plugin. While the immediate impact is limited to installing a specific plugin (YaySMTP), this represents a violation of the principle of least privilege and could be chained with other vulnerabilities.

The vulnerable code paths can be examined in the WordPress YayMail Ajax Code and WordPress YayMail Addon Controller. The missing capability checks allow the AJAX handler and REST endpoint to process requests without verifying that the requesting user has the install_plugins or activate_plugins capabilities.

Detection Methods for CVE-2026-1831

Indicators of Compromise

• Unexpected installation or activation of the YaySMTP plugin on WordPress sites
• AJAX requests to yaymail_install_yaysmtp action from Shop Manager accounts
• REST API calls to /yaymail/v1/addons/activate from non-administrator users
• Audit log entries showing plugin installations by users without install_plugins capability

Detection Strategies

• Monitor WordPress AJAX action logs for yaymail_install_yaysmtp requests from non-administrator users
• Implement logging on REST API endpoints matching /yaymail/v1/addons/* patterns
• Review WordPress plugin installation history for unauthorized YaySMTP installations
• Enable WordPress security plugins that detect unauthorized privilege usage

Monitoring Recommendations

• Configure web application firewall (WAF) rules to alert on AJAX requests containing yaymail_install_yaysmtp
• Implement role-based activity monitoring for Shop Manager accounts
• Set up alerts for plugin state changes initiated through non-standard interfaces
• Review server access logs for REST API calls to YayMail addon endpoints

How to Mitigate CVE-2026-1831

Immediate Actions Required

• Update the YayMail plugin to a version newer than 4.3.2 that includes proper capability checks
• Audit installed plugins to verify no unauthorized YaySMTP installations have occurred
• Review Shop Manager account activity for suspicious API calls or plugin installations
• Consider temporarily restricting Shop Manager capabilities until the patch is applied

Patch Information

The vulnerability has been addressed in versions of YayMail released after 4.3.2. Review the YayMail Changeset Overview for specific code changes implemented to resolve this vulnerability. The patch adds proper capability verification using WordPress's current_user_can() function to ensure only administrators with install_plugins capability can trigger plugin installation. For additional technical details, consult the Wordfence Vulnerability Analysis.

Workarounds

• Implement a custom WordPress filter to restrict AJAX action access to administrators only
• Use a security plugin to block unauthorized REST API requests to YayMail endpoints
• Temporarily disable the YayMail plugin if an immediate update is not possible
• Restrict Shop Manager accounts to essential WooCommerce functions pending remediation

# Example: Add capability check via wp-config.php or custom plugin
# This is a temporary workaround - apply official patch when available
# Add to functions.php or a custom security plugin:

# Block unauthorized access to yaymail_install_yaysmtp AJAX action
add_action('wp_ajax_yaymail_install_yaysmtp', function() {
    if (!current_user_can('install_plugins')) {
        wp_die('Unauthorized access');
    }
}, 1);