CVE-2026-39498: WordPress YayMail plugin <= 4.3.3 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where an attacker supplies a crafted serialized PHP string that the application deserializes, potentially triggering arbitrary code execution through gadget chains already present in the codebase. The YayMail WordPress plugin (versions 4.3.3 and below) is reachable over the network and requires a shop manager-level account to exploit. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected environment. No fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP/HTTPS.

• AuthenticationRequired

  A shop manager-level account (or higher) is required; a low-privilege standard subscriber account is not sufficient.

• Victim interactionNot required

  No victim interaction is needed; the attacker can trigger the vulnerability directly once authenticated.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental layout.

Blast Radius

• Reads sensitive data stored in the WordPress database, including order records, customer details, and configuration secrets.
• Modifies or deletes persisted database content, including plugin settings, user records, and order data.
• Executes arbitrary PHP code on the server through deserialization gadget chains, enabling full host-level compromise.
• Crashes or destabilizes the WordPress application, causing service disruption for storefront visitors and administrators.