CVE-2026-27327

WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability

Published Feb 19, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

Missing Authorization vulnerability in YayCommerce YayMail yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayMail: from n/a through <= 4.3.2.

Analysis

Technical impact

The YayMail WooCommerce Email Customizer plugin for WordPress fails to enforce proper permission checks, allowing attackers to bypass intended security controls. This missing authorization flaw (CWE‑862) could enable unauthorized modification or viewing of e‑mail templates and related data, potentially compromising customer communications.

Affected Systems

YayCommerce YayMail plugin on WordPress, affecting all releases up to version 4.3.2; the earliest affected version is not specified. Sites running any of these versions are vulnerable until a patch or newer release is applied.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate impact potential, while the EPSS score of less than 1 % suggests a very low current exploitation probability. The vulnerability is not listed in the KEV catalog. Although the exact attack vector is not explicitly described, it is inferred to be web‑based, with attackers able to send crafted HTTP requests to plugin endpoints to exploit the broken access control. No specific prior conditions are detailed, but the flaw likely arises from improperly configured permission settings within the plugin.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

YayCommerce

YayMail

unaffected

Version	Status	Constraints
`0`	affected	≤ 4.3.2

No data.

Vendor Product Versions

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Yaycommerce

Yaymail – Woocommerce Email Customizer

Version	Status	Scheme	Platform
`[0,4.3.2]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest YayMail plugin update (≥4.3.3) to eliminate the broken access control flaw.
If no update is currently available, temporarily disable or uninstall the YayMail plugin until a vendor patch is released.
Configure WordPress role permissions so that only administrators can access WooCommerce email customization features, enforcing least privilege for all other user roles.

Generated by OpenCVE AI on April 16, 2026 at 06:25 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.238% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/yaymail/vulnerability/wordpress-yaymail-woocommerce-email-customizer-plugin-4-3-2-broken-access-control-vulnerability?_s_id=cve

History

Apr 1, 2026 11:45 PM Description updated View changes

Type	Values Removed	Values Added
Description	Missing Authorization vulnerability in YayCommerce YayMail – WooCommerce Email Customizer yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayMail – WooCommerce Email Customizer: from n/a through <= 4.3.2.	Missing Authorization vulnerability in YayCommerce YayMail yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayMail: from n/a through <= 4.3.2.

Feb 27, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 20, 2026 10:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress Yaycommerce Yaycommerce yaymail – Woocommerce Email Customizer
Vendors & Products		Wordpress Wordpress wordpress Yaycommerce Yaycommerce yaymail – Woocommerce Email Customizer

Feb 19, 2026 9:00 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Missing Authorization vulnerability in YayCommerce YayMail – WooCommerce Email Customizer yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayMail – WooCommerce Email Customizer: from n/a through <= 4.3.2.
Title		WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability
Weaknesses		CWE-862
References		https://patchstack.com/database/Wordpress/Plugin/yaymail/vulnerability/wordpress-yaymail-woocommerce-email-customizer-plugin-4-3-2-broken-access-control-vulnerability?_s_id=cve