Exploitation Research Plan: CVE-2026-1938 - YayMail License Deletion

1. Vulnerability Summary

The YayMail – WooCommerce Email Customizer plugin (versions <= 4.3.2) fails to implement proper authorization checks on its custom REST API endpoint /yaymail-license/v1/license/delete. While the endpoint is protected by a WordPress REST API nonce (ensuring the request is from a legitimate session), it does not verify that the authenticated user possesses administrative privileges before proceeding with the license key deletion. This allows users with the Shop Manager role (standard in WooCommerce) to delete the plugin's license, potentially disabling premium features and support.

2. Attack Vector Analysis

• Endpoint: /wp-json/yaymail-license/v1/license/delete
• Method: POST (inferred as the standard for action-based deletion in YayMail's REST structure) or DELETE.
• Authentication: Required (at least Shop Manager level).
• Required Parameter: _wpnonce (sent via X-WP-Nonce header or _wpnonce body parameter).
• Vulnerability Type: Missing Authorization (Insecure Direct Object Reference / Broken Access Control).

3. Code Flow (Inferred)

The vulnerability resides in the REST API registration logic, likely within the plugin's license management component.

1. Registration: The plugin registers the route using register_rest_route('yaymail-license/v1', '/license/delete', ...).
2. Vulnerable Parameter: The permission_callback for this route is likely missing, set to __return_true, or only checks if the user is logged in (e.g., is_user_logged_in()) without checking for manage_options or specific license-management capabilities.
3. Execution: The controller function associated with the route calls the internal license deletion logic (likely delete_option('yaymail_license_key') or similar).

4. Nonce Acquisition Strategy

The endpoint requires a valid WordPress REST API nonce (wp_rest action). This nonce is tied to the user's session.

1. User Role: The attacker must be logged in as a Shop Manager.
2. Strategy:
   • Log in to the WordPress admin dashboard as a Shop Manager.
   • Navigate to any admin page (e.g., /wp-admin/index.php).
   • Use the browser_eval tool to extract the global WordPress REST settings.
   • JavaScript Variable: window.wpApiSettings.nonce
   • Alternative Location: If wpApiSettings is missing, the nonce can often be found in the header of the page source: grep -oP 'var wpApiSettings = \{.*"nonce":"\K[a-f0-9]{10}'.

5. Exploitation Strategy

Step 1: Pre-exploitation Setup

1. Ensure WooCommerce and YayMail are active.
2. Create a user with the shop_manager role.
3. Set a dummy license key in the database to verify deletion:
   wp option update yaymail_license_key "VULN-RESEARCH-PRO-KEY-1234"
wp option update yaymail_license_status "active"

Step 2: Acquire Nonce

1. Log in to the site as the Shop Manager using the browser_navigate and browser_type tools.
2. Execute: browser_eval("window.wpApiSettings.nonce") to retrieve the nonce string (e.g., a1b2c3d4e5).

Step 3: Trigger Deletion

Send the unprivileged request to the REST API.

Request:

POST /wp-json/yaymail-license/v1/license/delete HTTP/1.1
Host: [TARGET_HOST]
X-WP-Nonce: [ACQUIRED_NONCE]
Content-Type: application/json

{}

(Note: If POST fails, retry with the DELETE method).

Step 4: Verification

Verify if the license options were removed.

6. Test Data Setup

• Plugin Version: YayMail 4.3.2.
• Dependency: WooCommerce (required for Shop Manager role).
• Attacker User:
  • Username: shopmgr_attacker
  • Password: password123
  • Role: shop_manager
• Initial State:
  • yaymail_license_key option exists in wp_options.

7. Expected Results

• Success Response: 200 OK or 204 No Content, likely with a JSON body indicating success (e.g., {"success": true}).
• Unauthorized Response (If Patched): 403 Forbidden with an "rest_cannot_edit" or "rest_forbidden" error code.
• Impact: The yaymail_license_key option is deleted from the database.

8. Verification Steps (Post-Exploit)

Run the following WP-CLI commands to confirm the license was successfully deleted by the unauthorized user:

# Check if the license key option still exists
wp option get yaymail_license_key

# Expected output: "Error: Could not get 'yaymail_license_key' option."

9. Alternative Approaches

If the REST endpoint /yaymail-license/v1/license/delete requires specific parameters not mentioned in the advisory:

1. Parameter Discovery: Use browser_navigate to the YayMail license settings page as an Admin and monitor network requests in the browser console when clicking "Delete License" or "Deactivate".
2. Method Variance: If POST returns 404 or 405, try DELETE.
3. Legacy AJAX: Check if there is a corresponding wp_ajax_ fallback:
   grep -rn "wp_ajax_yaymail_license_delete" . (inferred action name).