Technical impact
The YayMail WooCommerce Email Customizer contains missing capability checks on the AJAX action 'yaymail_install_yaysmtp' and the REST endpoint '/yaymail/v1/addons/activate', permitting authenticated users with Shop Manager or higher roles to install and activate the YaySMTP plugin. This flaw allows an attacker to add additional code to the site without proper authorization, potentially leading to broader privilege escalation or malicious plugin deployment.
Affected Systems
The vulnerability affects all YayMail plugin versions up to 4.3.2 installed on WordPress sites. Users who have the Shop Manager role or higher within WooCommerce should consider these installations as impacted.
Risk and Exploitability
The CVSS score of 2.7 indicates low severity, and the EPSS score of less than 1% reflects a very small likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no publicly known exploit. The likely attack vector is through a compromised authenticated session on the WordPress admin interface or via a REST call, with the attacker needing at least Shop Manager privileges. Exploitation would allow installation of a third‑party plugin without proper authorization, potentially compromising site functionality or enabling further attacks.
