What is CVE-2026-1831?

CVE-2026-1831 is a low-severity vulnerability in Yaycommerce Yaymail – Woocommerce Email Customizer, classified under Missing Authorization. CVSS score: 2.7/10. Published 2026-02-18.

How severe is CVE-2026-1831?

Low severity. CVSS v3 base score is 2.7 out of 10.

Auth bypass in Yaycommerce Yaymail – Woocommerce Email Customizer

CVE-2026-1831

The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized plugin installation and activation due to missing capability checks on the 'yaymail_install_yaysmtp' AJAX action and `/yaymail/v1/addons/activate` REST endpoint in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to install and activate the YaySMTP plugin.

Vulnerability class: Broken Access Control

EPSS: 0.003 (21.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N.

Affected products

Yaycommerce Yaymail – Woocommerce Email Customizer — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Frequently asked questions

What is CVE-2026-1831?: CVE-2026-1831 is a low-severity vulnerability in Yaycommerce Yaymail – Woocommerce Email Customizer, classified under Missing Authorization. CVSS score: 2.7/10. Published 2026-02-18.
How severe is CVE-2026-1831?: Low severity. CVSS v3 base score is 2.7 out of 10.