Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized license key deletion due to a missing authorization check on the `/yaymail-license/v1/license/delete` REST endpoint in versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to delete the plugin's license key via the '/yaymail-license/v1/license/delete' endpoint granted they can obtain the REST API nonce.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1938 Unauthorized License Key Deletion in YayMail WordPress Plugin via REST Endpoint https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1938
Post summary
The CVE-2026-1938 report discloses an unauthorized license key deletion flaw in the YayMail WordPress plugin through a REST endpoint, with no PoC, exploit, patch, or active exploitation details provided.
CVE-2026-1938 The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized license key deletion due to a missing authorization check on the `/yaymail… https://www.cve.org/CVERecord?id=CVE-2026-1938
Post summary
The YayMail WooCommerce plugin allows unauthorized license key deletion because of a missing authorization check.