Research Plan: CVE-2026-27327 - YayMail Missing Authorization

1. Vulnerability Summary

The YayMail – WooCommerce Email Customizer plugin (<= 4.3.2) fails to implement proper capability checks (authorization) on several of its AJAX handlers. Specifically, functions intended for administrators (like saving email templates, duplicating templates, or resetting configurations) are registered via wp_ajax_ hooks without verifying if the requesting user has the manage_woocommerce or manage_options capability. This allows any authenticated user with Contributor-level access or higher to modify or corrupt WooCommerce email templates.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Authentication: Contributor-level account required.
• Vulnerable Hook: wp_ajax_yaymail_save_elements or wp_ajax_yaymail_duplicate_template (inferred based on plugin logic).
• Payload Parameter: action, nonce, and specific data parameters like templateId, elements (JSON-encoded email structure).

3. Code Flow (Inferred)

1. The plugin registers AJAX actions in a controller class (likely within includes/ or includes/Admin/Ajax.php).
2. Example Registration: add_action('wp_ajax_yaymail_save_elements', array($this, 'save_elements'));
3. The callback function save_elements() is invoked.
4. The function checks for a nonce using check_ajax_referer('yaymail-nonce', 'nonce').
5. Vulnerability: The function proceeds to update post meta or database options without calling current_user_can('manage_woocommerce').
6. User-supplied template data is saved to the database, affecting how customers receive emails.

4. Nonce Acquisition Strategy

YayMail localizes its configuration and security tokens into a JavaScript object. Based on the entry point yaymail-main.tsx-523766ce.js, the data is likely localized for the yaymail-main handle.

1. Identify Script Handle: Search PHP for wp_localize_script. Look for the object name (e.g., YayMail or YayMailSettings).
2. Setup: A Contributor user can access the WordPress dashboard (/wp-admin/). While they may not see the YayMail menu, the scripts and nonces are often loaded on all admin pages or can be triggered by navigating to the plugin's admin page slug directly (/wp-admin/admin.php?page=yaymail-settings).
3. Extraction:
   • Use browser_navigate to /wp-admin/index.php.
   • Use browser_eval to extract the nonce:

     // Likely candidate for the localized object
     window.YayMail?.nonce || window.YayMailSettings?.nonce
     

4. Bypass Check: If the nonce is strictly limited to the YayMail admin page (which Contributors can't access), check if the wp_ajax_ handler verifies the nonce correctly or if the nonce is leaked on all admin pages via a global admin_enqueue_scripts hook.

5. Exploitation Strategy

We will target the email template modification functionality to demonstrate unauthorized data manipulation.

Step 1: Discover Template IDs

Use WP-CLI to find an existing YayMail template ID to target.

wp post list --post_type=yaymail_template --format=ids

Step 2: Extract Nonce

Navigate to the dashboard as a Contributor and extract the yaymail-nonce.

Step 3: Execute Unauthorized Modification

Send a POST request to admin-ajax.php to modify a template.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=yaymail_save_elements&
  nonce=[EXTRACTED_NONCE]&
  templateId=[TEMPLATE_ID]&
  elements=[{"type":"text","content":"EXPLOITED BY CONTRIBUTOR"}]
  

6. Test Data Setup

1. Install Dependencies: Ensure WooCommerce and YayMail (<= 4.3.2) are installed and active.
2. Create Template: Create at least one YayMail template for "New Order".
   • wp eval "YayMail\Helper\Helper::create_default_templates();" (or similar internal helper if known).
3. Create User:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password
   

7. Expected Results

• Response: The server should return a JSON success message (e.g., {"success":true}).
• Impact: The template data for the specified templateId is updated in the wp_postmeta table (look for _yaymail_elements or similar meta keys).

8. Verification Steps

After the exploit, verify the database state using WP-CLI:

# Check if the post meta was updated
wp post meta get [TEMPLATE_ID] _yaymail_elements

If the output contains "EXPLOITED BY CONTRIBUTOR", authorization was successfully bypassed.

9. Alternative Approaches

If yaymail_save_elements is not the vulnerable action, search the PHP codebase for other unprotected actions:

1. grep -r "wp_ajax_yaymail_" .
2. For each found action, check the corresponding function for current_user_can.
3. Other high-impact targets:
   • yaymail_duplicate_template: Create arbitrary copies of templates.
   • yaymail_reset_template: Delete existing customizations.
   • yaymail_save_settings: Modify global plugin settings (e.g., SMTP settings if integrated).