CVE-2026-1937 is a missing authorization vulnerability (CWE-862) in the YayMail – WooCommerce Email Customizer plugin for WordPress, affecting all versions up to 4.3.2. The flaw exists because the yaymail_import_state AJAX action lacks proper capability checks, enabling authenticated users with Shop Manager or higher privileges to update arbitrary WordPress options. This can be exploited to escalate privileges by setting the default registration role to administrator and enabling user registration, thereby allowing attackers to create administrative accounts on the affected site.

Successful exploitation allows attackers with Shop Manager-level access to escalate privileges to administrator by modifying critical site options. This compromises the integrity and confidentiality of the WordPress site, potentially leading to full site takeover. The vulnerability impacts site security by enabling unauthorized administrative user creation and control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Shop Manager-level access to trusted users only and consider disabling or limiting the use of the affected plugin. Monitor for updates from the vendor and apply official patches promptly once released.