{"id":"CVE-2026-42701","kind":"vulnerability","aliases":["CVE-2026-42701"],"related":[],"title":"YayMail WooCommerce plugin: PHP object injection by shop managers","description":"Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.","summary":"YayMail, a WordPress plugin for WooCommerce email templates, up to version 4.4.6 is vulnerable to PHP Object Injection. A user with shop manager rights can exploit it to run code or manipulate application logic on the site.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"YayMail","fixed":["4.4.7"],"affected":"<= 4.4.6","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","php-object-injection","woocommerce","wordpress","yaymail"],"not_affected_if":["no-shop-manager-accounts-untrusted","plugin-not-installed","version-4.4.7-or-later","yaymail-not-installed"],"how_to_check":"WordPress admin > Plugins: if YayMail is 4.4.6 or lower, it is affected. Or run: wp plugin get yaymail --field=version","fix":"Update YayMail to 4.4.7 or later (per Patchstack; not yet confirmed on vendor changelog).","status":"open","published_at":"2026-10-29T16:18:09+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:29:44+00:00","updated_at":"2026-10-29T16:37:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T16:29:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"YayMail WooCommerce plugin: PHP object injection by shop managers","impact":"high","summary":"YayMail, a WordPress plugin for WooCommerce email templates, up to version 4.4.6 is vulnerable to PHP Object Injection. A user with shop manager rights can exploit it to run code or manipulate application logic on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","yaymail"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the server through a crafted serialized object","analyst_note":"Confirm the fixed version and the exact vulnerable component on the NVD page (https://nvd.nist.gov/vuln/detail/CVE-2026-42701).","how_to_check":"- Check the installed YayMail plugin version in the WordPress admin under Plugins.\n- Compare against the vulnerable range `<= 4.4.6`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-shop-manager-accounts-untrusted"],"who_is_affected":"Sites running the YayMail WooCommerce email plugin at version 4.4.6 or earlier are exposed. Exploitation requires a shop manager account, so sites where only trusted staff hold that role have lower risk. Sites not using YayMail can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000677,"input_tokens":4046,"output_tokens":544,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the exact vulnerable component on the NVD page (https://nvd.nist.gov/vuln/detail/CVE-2026-42701).","search":"'-2026':11A,14A '-42701':12A,15A '4.4.6':36B,69C 'applic':57B 'code':54B 'cve':10A,13A 'email':31B 'exploit':50B 'inject':6A,21B,42B,66C 'logic':58B 'manag':9A,47B,63C 'manipul':56B 'object':5A,20B,41B,65C 'packag':17B 'php':4A,19B,40B,64C 'php-object-inject':18B 'plugin':3A,28B 'right':48B 'run':53B 'shop':8A,46B,62C 'site':61B 'templat':32B 'user':44B 'version':35B,70C 'vulner':38B 'woocommerc':2A,22B,30B 'wordpress':23B,27B 'yaymail':1A,16A,24B,25B,68C","nicknames":[],"mitigations":[],"who_affected":"WordPress/WooCommerce sites running the YayMail email customizer plugin at 4.4.6 or earlier. The attacker needs a logged-in account with shop manager rights or higher, so risk is highest on shops with several staff or contractor accounts, or where a manager account could be phished. Sites without YayMail can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-42701","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42701","severity":null,"published_at":"2026-10-29T16:18:09+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-42701:1073","url":null,"severity":null,"published_at":"2026-10-29T16:37:03+00:00","modified_at":"2026-10-29T16:37:03+00:00","first_seen_at":"2026-10-29T16:37:03+00:00","fetched_at":"2026-10-29T16:37:03+00:00","note":"Patchstack (third-party, reported 17 Sep, published 13 Oct) says <=4.4.6 vulnerable, fixed in 4.4.7. YayMail's own changelog, as read, stops at 4.4.5 and does not mention 4.4.7 or this CVE, so nothing is verified. No exploitation or public PoC found. Same plugin had an earlier shop-manager POI, CVE-2026-39498, fixed in 4.3.4."}],"documents":[{"id":17798,"url":"https://patchstack.com/database/wordpress/plugin/yaymail/vulnerability/wordpress-yaymail-plugin-4-4-6-php-object-injection-vulnerability","title":"Patchstack: YayMail <= 4.4.6 PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":17799,"url":"https://docs.yaycommerce.com/yaymail/other-links/changelog","title":"YayMail changelog (lists up to 4.4.5 when read)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}