The vulnerability CVE-2026-39496 in YayCommerce YayMail (<= 4.3.3) is a blind SQL injection caused by improper neutralization of special elements in SQL commands. The CVSS 3.1 score is 7.6 (high), with network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, high confidentiality impact, no integrity impact, and low availability impact. No vendor advisory or patch information is available, and no known exploits in the wild have been reported.

Successful exploitation could allow an attacker with high privileges to perform blind SQL injection attacks, potentially exposing sensitive data (confidentiality impact is high). Integrity is not impacted, and availability impact is low. The vulnerability could lead to unauthorized data disclosure within the affected YayMail plugin environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected YayMail plugin to trusted users with high privileges and monitor for unusual database activity related to YayMail. Avoid exposing the plugin to untrusted networks or users.