4.3
MediumCVSS 3.1 · from Patchstack
CVE-2026-27327
WordPress YayMail – WooCommerce Email Customizer plugin <= 4.3.2 - Broken Access Control vulnerability
yaymail · Missing authorization · CWE-862Affectedyaymail
FixUpdate to 4.3.3 or newer
PublishedFeb 19, 20:35 · Patchstack
ScoredFeb 19 · 4.3 · Patchstack
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
Missing Authorization vulnerability in YayCommerce YayMail yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayMail: from n/a through <= 4.3.2.
From Patchstack
Affected and fixed versions
ProductAffectedFixed inyaymailearlier versions4.3.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known