---
id: "CVE-2026-42701"
kind: "vulnerability"
aliases: ["CVE-2026-42701"]
title: "YayMail WooCommerce plugin: PHP object injection by shop managers"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "YayMail", "fixed": ["4.4.7"], "affected": "<= 4.4.6", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "php-object-injection", "woocommerce", "wordpress", "yaymail"]
not_affected_if: ["no-shop-manager-accounts-untrusted", "plugin-not-installed", "version-4.4.7-or-later", "yaymail-not-installed"]
published_at: "2026-10-29T16:18:09+00:00"
first_seen_at: "2026-10-29T16:25:59+00:00"
updated_at: "2026-10-29T16:37:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42701", "first_seen_at": "2026-10-29T16:25:59+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T16:37:03+00:00"}]
---

# YayMail WooCommerce plugin: PHP object injection by shop managers

YayMail, a WordPress plugin for WooCommerce email templates, up to version 4.4.6 is vulnerable to PHP Object Injection. A user with shop manager rights can exploit it to run code or manipulate application logic on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:YayMail affected <= 4.4.6 fixed 4.4.7

## How to check

WordPress admin > Plugins: if YayMail is 4.4.6 or lower, it is affected. Or run: wp plugin get yaymail --field=version

## Fix

Update YayMail to 4.4.7 or later (per Patchstack; not yet confirmed on vendor changelog).

## Timeline

- 2026-10-29T16:25:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-42701
- 2026-10-29T16:37:03+00:00 analyst — Patchstack (third-party, reported 17 Sep, published 13 Oct) says <=4.4.6 vulnerable, fixed in 4.4.7. YayMail's own changelog, as read, stops at 4.4.5 and does not mention 4.4.7 or this CVE, so nothing is verified. No exploitation or public PoC found. Same plugin had an earlier shop-manager POI, CVE-2026-39498, fixed in 4.3.4.

## Documents

- [advisory] Patchstack: YayMail <= 4.4.6 PHP Object Injection https://patchstack.com/database/wordpress/plugin/yaymail/vulnerability/wordpress-yaymail-plugin-4-4-6-php-object-injection-vulnerability
- [mentions] YayMail changelog (lists up to 4.4.5 when read) https://docs.yaycommerce.com/yaymail/other-links/changelog

## From the sources

Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_