Live › vulnerability › CVE-2026-42701
YayMail, a WordPress plugin for WooCommerce email templates, up to version 4.4.6 is vulnerable to PHP Object Injection. A user with shop manager rights can exploit it to run code or manipulate application logic on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
WordPress/WooCommerce sites running the YayMail email customizer plugin at 4.4.6 or earlier. The attacker needs a logged-in account with shop manager rights or higher, so risk is highest on shops with several staff or contractor accounts, or where a manager account could be phished. Sites without YayMail can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| YayMail | wordpress | <= 4.4.6 | 4.4.7 |
4.4.6 or lower, it is affectedUpdate YayMail to or later (per Patchstack; not yet confirmed on vendor changelog).
4.4.7Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-42701")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.