Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized plugin installation and activation due to missing capability checks on the 'yaymail_install_yaysmtp' AJAX action and `/yaymail/v1/addons/activate` REST endpoint in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to install and activate the YaySMTP plugin.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1831 The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized plugin installation and activation due to missing capability checks on the… https://www.cve.org/CVERecord?id=CVE-2026-1831
Post summary
CVE-2026-1831 discloses a missing capability check in the YayMail WooCommerce Email Customizer plugin, allowing unauthorized plugin installation and activation.
CVE-2026-1831 Unauthorized Plugin Installation in WooCommerce YayMail Plugin via Capability Bypass https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1831
Post summary
The text offers a brief disclosure of CVE-2026-1831, noting an unauthorized plugin installation via capability bypass in the WooCommerce YayMail plugin, with no further details on exploitation or mitigation.