Technical impact
The vulnerability arises from a missing capability check on the yaymail_import_state AJAX action in the YayMail – WooCommerce Email Customizer plugin. Authenticated users with Shop Manager or higher privileges can trigger this action and modify WordPress options arbitrarily. An attacker can change the default registration role to administrator or enable user registration, allowing the creation of an administrative account. This flaw directly leads to privilege escalation and compromise of site integrity.
Affected Systems
Victims are WordPress sites running the YayMail – WooCommerce Email Customizer plugin versions up to and including 4.3.2. Any installation of these versions, regardless of WordPress core version, is susceptible. The issue is present in all prior releases because the capability check was never added to the AJAX handler.
Risk and Exploitability
The CVSS base score is 7.2, indicating high severity. The EPSS score is below 1%, reflecting very low probability of exploitation in the wild at this time, and the vulnerability is not listed in the CISA KEV catalog. However, exploitation requires only an authenticated Shop Manager level account, which is often granted to legitimate staff. Once the action is triggered, the attacker can manipulate critical options without additional privileges, making the risk significant despite low external exploit prevalence. The attack vector is therefore internal, relying on social engineering or compromise of a legitimate administrator account.
