Yeeaddons vulnerabilities and threats

A high-severity vulnerability (CVE-2026-39498) exists in Yeeaddons YayMail versions up to and including 4.3.3. It involves PHP Object Injection due to deserialization of untrusted data, allowing a shop manager level user to potentially execute malicious actions. The vulnerability has a CVSS score of 7.2, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor.