CVE-2026-92553: YaySMTP WordPress Plugin RCE Vulnerability

CVE-2026-92553 Overview

The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress contains an arbitrary file upload vulnerability in all versions up to and including 2.7.7. The flaw resides in the putFile function, which performs insufficient file type validation when handling email log attachments. Authenticated attackers with subscriber-level access or higher can upload executable files, leading to remote code execution on vulnerable servers. The vulnerability is classified under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Authenticated subscribers can achieve remote code execution on WordPress sites running YaySMTP 2.7.7 and earlier when hosted on nginx or Apache configured with AllowOverride None.

Affected Products

YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress
All versions up to and including 2.7.7
Deployments on nginx and Apache with AllowOverride None

Discovery Timeline

2026-10-16 - CVE CVE-2026-92553 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-92553

Vulnerability Analysis

The vulnerability resides in the putFile function within includes/Helper/EmailLogAttachments.php. The function accepts file uploads associated with email log attachments but fails to enforce an allow-list of permitted extensions, perform MIME type verification, or rename uploaded files to a safe extension. WordPress's sanitize_file_name() is used as the only normalization step, which does not strip executable extensions such as .php, .phtml, or .phar.

An authenticated attacker with subscriber-level privileges can submit a crafted upload request containing a PHP payload. The file is written to a plugin-controlled directory with its executable extension intact. When the attacker requests the uploaded file over HTTP, the web server interprets and executes the PHP code, yielding remote code execution under the web server user.

Root Cause

The root cause is missing server-side input validation combined with reliance on a client-visible protection mechanism. The plugin writes a .htaccess file via writeGuards() containing Require all denied to block direct access to uploaded attachments. This control is silently ignored by nginx, which does not process .htaccess directives, and by Apache instances configured with AllowOverride None. The sanitization path through sanitize_file_name() normalizes names but preserves dangerous extensions.

Attack Vector

Exploitation requires network access to the WordPress site and authentication as a subscriber or higher. The attacker invokes the plugin's attachment upload endpoint, submits a file with an executable extension and PHP payload, then requests the stored file by URL. On vulnerable server configurations, the request triggers interpretation of the payload. Review the vulnerable sinks in EmailLogAttachments.php line 106 and line 549, and the fix in changeset 3739875.

Detection Methods for CVE-2026-92553

Indicators of Compromise

Files with executable extensions such as .php, .phtml, .phar, or .pht within the YaySMTP attachments storage directory under wp-content/.
Unexpected subscriber-role accounts created immediately before suspicious file writes under the plugin directory.
HTTP POST requests to YaySMTP attachment endpoints from low-privilege sessions, followed by GET requests to newly created files.
Web shell indicators such as outbound connections, new cron entries, or modified wp-config.php originating from the web server user.

Detection Strategies

Scan the WordPress installation for files with scripting extensions located inside the YaySMTP uploads path and compare against known plugin assets.
Correlate authenticated upload events with subsequent direct GET requests to the uploaded filenames in web server logs.
Monitor for PHP process creation initiated by the web server user that spawns shells, package managers, or network utilities.

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/uploads/ and plugin attachment directories.
Alert on creation of any .htaccess file whose directives do not match the expected baseline.
Forward WordPress audit logs, nginx and Apache access logs to a centralized log platform to correlate low-privilege uploads with executable file access.

How to Mitigate CVE-2026-92553

Immediate Actions Required

Update the YaySMTP plugin to the version published after changeset 3739875.
Audit WordPress user accounts and remove any unexpected subscriber or higher accounts created recently.
Inspect the plugin attachment directory for files with executable extensions and remove any confirmed web shells.
Rotate WordPress administrator credentials, API keys, and database passwords if compromise is suspected.

Patch Information

The vendor addressed the issue in the YaySMTP source tree. Review the fix in WordPress changeset 3739875 and the vulnerability write-up at Wordfence Vulnerability Analysis. Administrators should upgrade past version 2.7.7.

Workarounds

Deactivate the YaySMTP plugin until the patched version is deployed.
On nginx, add a location block that denies direct access to the plugin's attachment directory and returns 403 for requests to scripting extensions.
On Apache, set AllowOverride All for the WordPress document root so the plugin's .htaccessRequire all denied directive is enforced, or add equivalent <Directory> rules in the main server configuration.
Restrict subscriber-level registration or disable open registration via WordPress general settings while the patch is pending.

bash

# nginx: block script execution inside YaySMTP attachments directory
location ~* /wp-content/uploads/yaysmtp/.*\.(php|phtml|phar|pht)$ {
    deny all;
    return 403;
}