CVE-2026-39498 is a PHP Object Injection vulnerability classified under CWE-502 affecting YayMail versions <=4.3.3. This vulnerability arises from unsafe deserialization of untrusted data, which can be exploited by a user with shop manager privileges to execute arbitrary code or manipulate application behavior. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch is currently available, and no known exploits in the wild have been reported.

Successful exploitation could lead to full compromise of the affected application, including unauthorized disclosure, modification, or destruction of data, and disruption of service. The attacker must have shop manager privileges, which limits the initial access vector but still poses a significant risk within the application environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict shop manager privileges to trusted users only and monitor for suspicious activity related to deserialization processes. Avoid importing or processing untrusted serialized data where possible.