CVE-2026-1938: YayMail WooCommerce Auth Bypass Vulnerability

CVE-2026-1938 Overview

CVE-2026-1938 affects the YayMail – WooCommerce Email Customizer plugin for WordPress. The vulnerability allows unauthorized license key deletion through the /yaymail-license/v1/license/delete REST endpoint. Versions up to and including 4.3.2 are affected. The root cause is a missing authorization check [CWE-862] on the REST route handler. Authenticated attackers with Shop Manager-level access or above can invoke the endpoint and remove the plugin's license key, provided they can obtain the REST API nonce. The flaw impacts integrity by enabling unauthorized state changes to license data but does not expose confidential information or directly disrupt site availability.

Critical Impact
Authenticated users at Shop Manager level can delete the YayMail plugin license key, disabling licensed functionality and updates until the key is restored.

Affected Products

YayMail – WooCommerce Email Customizer plugin for WordPress
All versions up to and including 4.3.2
WordPress sites running WooCommerce with YayMail installed

Discovery Timeline

2026-02-18 - CVE-2026-1938 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1938

Vulnerability Analysis

The YayMail plugin registers a REST API route at /yaymail-license/v1/license/delete to manage the plugin's license key. The route handler in src/License/RestAPI.php does not verify whether the calling user holds the appropriate administrative capability before performing the delete action. WordPress treats the request as authorized as long as the REST nonce is valid and the user is authenticated, which includes any role with REST API access.

Because Shop Manager is a WooCommerce role intended for store operations rather than plugin administration, this role should not control license state. The missing capability check collapses the privilege boundary between store operators and site administrators for this specific action. An attacker abusing a compromised Shop Manager account, or a malicious insider with that role, can invalidate the license without leaving administrative audit trails tied to license management.

Root Cause

The handler maps to CWE-862: Missing Authorization. The permission_callback for the delete route does not enforce a manage_options or equivalent capability check. See the affected source in the YayMail RestAPI.php at line 142.

Attack Vector

Exploitation requires an authenticated session with Shop Manager privileges or higher and a valid WordPress REST API nonce. The attacker issues an authenticated HTTP request to the vulnerable endpoint, which executes the delete logic without further capability validation. The attack runs over the network with low complexity and no user interaction. Impact is limited to integrity loss on the plugin's license configuration. Refer to the Wordfence advisory for additional context.

Detection Methods for CVE-2026-1938

Indicators of Compromise

HTTP requests to /wp-json/yaymail-license/v1/license/delete originating from non-administrator accounts
Unexpected removal of the YayMail license key from WordPress options, followed by license-invalid notices in the admin UI
Shop Manager account activity correlated with REST nonce retrieval from the YayMail admin pages

Detection Strategies

Review WordPress and web server access logs for POST or DELETE requests targeting the yaymail-license/v1/license route
Audit user roles to identify which non-administrator accounts have valid sessions capable of obtaining REST nonces
Correlate license-deletion events in the WordPress options table with the authenticated user ID recorded for the request

Monitoring Recommendations

Enable WordPress activity logging to capture REST API calls, including endpoint, user ID, and source IP
Alert on any state change to YayMail license options when the acting user is not an administrator
Monitor for repeated 200-OK responses from /wp-json/yaymail-license/* endpoints across short time windows

How to Mitigate CVE-2026-1938

Immediate Actions Required

Update the YayMail – WooCommerce Email Customizer plugin to a version later than 4.3.2 that includes the fix from Changeset #3460087
Audit all Shop Manager and higher-role accounts, removing unused or untrusted users
Rotate passwords and require multi-factor authentication for accounts with WooCommerce administrative roles

Patch Information

The vendor addressed the issue in WordPress plugin changeset 3460087, which adds an authorization check to the /yaymail-license/v1/license/delete route. Sites running version 4.3.2 or earlier must upgrade to the patched release. The current vulnerable handler is visible in the YayMail trunk source.

Workarounds

Temporarily restrict access to the /wp-json/yaymail-license/ namespace at the web server or WAF layer, allowing only administrator IP ranges
Reduce the number of accounts assigned the Shop Manager role until the patch is applied
Disable the YayMail plugin on production sites that cannot be updated immediately

bash

# Example nginx rule to block non-admin access to the vulnerable namespace
location ~ ^/wp-json/yaymail-license/ {
    allow 203.0.113.0/24;   # administrator network
    deny all;
}