7.6
HighCVSS 3.1 · from Patchstack
CVE-2026-39496
WordPress YayMail plugin <= 4.3.3 - SQL Injection vulnerability
yaymail · SQL injection · CWE-89Affectedyaymail
FixUpdate to 4.3.4 or newer
PublishedApr 8, 08:30 · Patchstack
ScoredApr 8 · 7.6 · Patchstack
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
A successful attack can read data. CVSS impact.
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YayMail yaymail allows Blind SQL Injection.This issue affects YayMail: from n/a through <= 4.3.3.
From Patchstack
Affected and fixed versions
ProductAffectedFixed inyaymailearlier versions4.3.4
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known