Is CVE-2026-1937 actively exploited?

Yes. CVE-2026-1937 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2026-1937 be exploited remotely?

Yes. CVE-2026-1937 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-1937?

CVE-2026-1937 has a CVSS score of 9.8 (CRITICAL) and an EPSS exploitation probability of 0.06%.

HOME VULNERABILITIESCVE-2026-1937

CRITICALCISA KEVIN THE WILD

CVE-2026-1937

CWE-862Published: February 18, 2026· Updated: Feb 18, 2026

9.8

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:13.0th

Official Description

The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the `yaymail_import_state` AJAX action in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

NVD Source

Risk Analysis

This critical vulnerability in the YayMail – WooCommerce Email Customizer plugin for WordPress allows for unauthorized data modification and privilege escalation. Authenticated attackers with Shop Manager-level access can update arbitrary WordPress options, including changing the default registration role to administrator. With a CVSS score of 9.8 and confirmed exploitation by CISA (is_in_kev: true), this is an extremely urgent threat.

Active exploitation of this vulnerability has been observed in the wild. The CVSS vector (AV:N/AC:L) indicates that this flaw is remotely exploitable with low attack complexity, though it requires initial authentication.

Recommended Action

Update the YayMail – WooCommerce Email Customizer plugin to a version beyond 4.3.2 immediately. Review and restrict user roles and permissions, especially for those with Shop Manager-level access, to prevent unauthorized option changes.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-1937 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

CISA has added CVE-2026-1937 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.