CVE-2026-39498
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
There is a PHP Object Injection vulnerability in the shop manager in YayMail versions <= 4.3.3.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized code, potentially leading to serious security breaches.
Recommendation
It is recommended to update to the latest version of YayMail to mitigate this vulnerability.
Other vulnerabilities in YayMail
See all- CVE-2026-42701High
The YayMail WordPress plugin in versions up to 4.4.6 contains a PHP Object Injection vulnerability exploitable by a shop manager user. This can lead to injection of a malicious PHP object and further exploitation.
- CVE-2026-39496High
The YayMail plugin by YayCommerce up to version 4.3.3 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.
Original NVD description (English source)
Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS