CVE-2026-1937: YayMail WooCommerce Privilege Escalation

CVE-2026-1937 Overview

The YayMail – WooCommerce Email Customizer plugin for WordPress contains a critical authorization bypass vulnerability that enables privilege escalation through unauthorized modification of WordPress site options. The vulnerability stems from a missing capability check on the yaymail_import_state AJAX action in all versions up to and including 4.3.2. This flaw allows authenticated attackers with Shop Manager-level access or above to modify arbitrary WordPress options, ultimately enabling them to escalate privileges to administrator level.

Critical Impact

Attackers can modify the default user registration role to administrator and enable user registration, allowing complete administrative takeover of vulnerable WordPress sites.

Affected Products

• YayMail – WooCommerce Email Customizer plugin versions up to and including 4.3.2
• WordPress sites running vulnerable YayMail plugin versions
• WooCommerce installations utilizing YayMail for email customization

Discovery Timeline

• February 18, 2026 - CVE-2026-1937 published to NVD
• February 18, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1937

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a critical security weakness where the application fails to verify that a user is authorized to perform a specific action. In this case, the yaymail_import_state AJAX action within the YayMail plugin does not implement proper capability checks to validate whether the requesting user has sufficient privileges to modify WordPress site options.

The vulnerability is particularly severe because it allows authenticated users with relatively limited privileges (Shop Manager level) to manipulate core WordPress settings. By exploiting this flaw, attackers can modify the default_role option to set new user registrations to administrator level, then enable user registration if disabled. This attack chain results in full administrative access to the WordPress site.

Root Cause

The root cause of this vulnerability lies in the MigrationModel.php file within the YayMail plugin, specifically around line 143. The yaymail_import_state AJAX handler processes import operations without verifying that the requesting user has the appropriate WordPress capabilities (such as manage_options) to perform administrative actions. This missing capability check violates the principle of least privilege and creates an authorization bypass condition.

The vulnerable code path accepts AJAX requests from any authenticated user with Shop Manager-level access, then processes those requests to modify WordPress options without validating authorization. This architectural flaw allows privilege escalation by design rather than through a complex exploit chain.

Attack Vector

The attack is network-based and requires only low-privilege authenticated access to exploit. An attacker with Shop Manager credentials can send a crafted AJAX request to the yaymail_import_state action endpoint. The malicious request would include parameters to update WordPress options such as:

1. Setting default_role to administrator
2. Enabling users_can_register if currently disabled
3. Registering a new user account that automatically receives administrator privileges

The attack requires no user interaction and can be automated once initial authentication is achieved. The impact includes complete confidentiality, integrity, and availability compromise of the WordPress installation.

Detection Methods for CVE-2026-1937

Indicators of Compromise

• Unexpected changes to the default_role WordPress option, particularly if set to administrator
• New administrator user accounts created without legitimate authorization
• Unusual AJAX requests targeting the yaymail_import_state action from Shop Manager accounts
• Modifications to the users_can_register option without administrative action
• Unexpected option changes in the wp_options database table correlating with YayMail AJAX activity

Detection Strategies

• Monitor WordPress audit logs for option modifications originating from non-administrator users
• Implement Web Application Firewall (WAF) rules to detect and block suspicious AJAX requests to yaymail_import_state
• Review user role assignments for unauthorized privilege escalations
• Enable WordPress security plugin monitoring for option table changes

Monitoring Recommendations

• Configure alerts for any changes to security-critical WordPress options including default_role and users_can_register
• Implement logging for all AJAX actions targeting WooCommerce and YayMail endpoints
• Establish baseline administrator user counts and alert on deviations
• Monitor authentication events from Shop Manager and higher-privilege accounts for anomalous behavior

How to Mitigate CVE-2026-1937

Immediate Actions Required

• Update the YayMail plugin to a version newer than 4.3.2 that includes the security fix
• Audit existing WordPress administrator accounts to identify any unauthorized additions
• Review and reset the default_role option to ensure it's set appropriately (typically subscriber)
• Verify the users_can_register option matches your intended site configuration
• Consider temporarily disabling the YayMail plugin until patching is complete

Patch Information

The vulnerability has been addressed in plugin updates released after version 4.3.2. The fix implements proper capability checks on the yaymail_import_state AJAX action to ensure only users with appropriate administrative privileges can modify WordPress options. Administrators should update to the latest available version through the WordPress plugin repository. For technical details on the specific code changes, refer to the WordPress YayMail Changeset and the Wordfence Vulnerability Report.

Workarounds

• Implement Web Application Firewall rules to block AJAX requests to admin-ajax.php with action parameter yaymail_import_state from non-administrator users
• Restrict Shop Manager role capabilities through a WordPress security plugin until the patch is applied
• Temporarily deactivate the YayMail plugin if email customization functionality is not immediately required
• Add custom capability checks through a code snippet in functions.php to validate authorization on YayMail AJAX endpoints

# WordPress CLI commands to verify and reset critical options
wp option get default_role
wp option update default_role subscriber
wp option get users_can_register
wp option update users_can_register 0
wp user list --role=administrator --format=table