CVE-2026-1831

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized plugin installation and activation due to missing capability checks on the 'yaymail_install_yaysmtp' AJAX action and `/yaymail/v1/addons/activate` REST endpoint in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to install and activate the YaySMTP plugin.

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Feb 18, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-183116.1Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported doc CVE-2026-183126.1Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The appli CVE-2026-183134.3rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it CVE-2026-183159.8The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled CVE-2026-183169.1The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the i CVE-2026-183174.3The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass CVE-2026-183185.3IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authenticati CVE-2026-18324.3The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is vulnerable to unauthorized cache deletion due to a CVE-2026-183206.1Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attrib CVE-2026-183214.7Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd CVE-2026-183228.8The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This i CVE-2026-183237.2The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi