CVE-2026-42701: WordPress YayMail plugin <= 4.4.6 - PHP Object Injection vulnerability

An attacker needs Shop Manager privileges. The provided severity vector also indicates that no user interaction is required.

Yes. The attack vector is network-based and has low attack complexity, but exploitation requires high privileges.

The severity vector indicates high impact to confidentiality, integrity, and availability. Scope is unchanged.

Published Oct 29, 2026

Updated

Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress YayMail plugin to a version that resolves this vulnerability.
Fixed in 4.4.7

Oct 29, 2026

CVE Published

via MITRE·03:24 PM

Data Sourced

via MITRE·03:24 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:18 PM

DescriptionSeverityWeakness

An attacker needs Shop Manager privileges. The provided severity vector also indicates that no user interaction is required.

Yes. The attack vector is network-based and has low attack complexity, but exploitation requires high privileges.

The severity vector indicates high impact to confidentiality, integrity, and availability. Scope is unchanged.