The YayMail WooCommerce Email Customizer plugin for WordPress fails to enforce proper permission checks, allowing attackers to bypass intended security controls. This missing authorization flaw (CWE‑862) could enable unauthorized modification or viewing of e‑mail templates and related data, potentially compromising customer communications.

YayCommerce YayMail plugin on WordPress, affecting all releases up to version 4.3.2; the earliest affected version is not specified. Sites running any of these versions are vulnerable until a patch or newer release is applied.

The CVSS score of 4.3 indicates a moderate impact potential, while the EPSS score of less than 1 % suggests a very low current exploitation probability. The vulnerability is not listed in the KEV catalog. Although the exact attack vector is not explicitly described, it is inferred to be web‑based, with attackers able to send crafted HTTP requests to plugin endpoints to exploit the broken access control. No specific prior conditions are detailed, but the flaw likely arises from improperly configured permission settings within the plugin.